{"id":"CVE-2021-3670","aliases":["ALPINE-CVE-2021-3670","AZL-10662","DEBIAN-CVE-2021-3670","EUVD-2021-26962","GHSA-p9j9-qqwf-j574","OESA-2022-1735","OESA-2024-1703","SUSE-SU-2022:1576-1","SUSE-SU-2022:2307-1","UBUNTU-CVE-2021-3670","USN-5542-1","openSUSE-SU-2024:11882-1"],"status":"published","title":"MaxQueryDuration not honoured in Samba AD DC LDAP","description":"MaxQueryDuration not honoured in Samba AD DC LDAP","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02469,"percentile":0.84616,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2021-12-31T00:00:00Z","modified":"2026-11-06T02:45:10Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"samba","fixed_in":["4.15.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"samba","fixed_in":["4.15.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"samba","fixed_in":["4.15.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"samba","fixed_in":["4.15.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"samba","fixed_in":["4.15.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"samba","fixed_in":["4.15.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"samba","fixed_in":["4.15.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"samba","fixed_in":["4.15.9-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"samba","fixed_in":["2:4.16.0+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"samba","fixed_in":["2:4.16.0+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"samba","fixed_in":["2:4.16.0+dfsg-2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"samba","fixed_in":["4.11.12-12.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"samba","fixed_in":["4.11.12-11.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libldb","fixed_in":["2.0.12-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"ldb","fixed_in":["2.4.2-150300.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ldb","fixed_in":["2.4.2-150300.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"ldb","fixed_in":["2.4.2-150300.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"ldb","fixed_in":["2.4.2-150300.3.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"ldb","fixed_in":["2.4.2-150300.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"ldb","fixed_in":["2.4.2-150400.4.3.11"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"samba","fixed_in":["4.15.7+git.376.dd43aca9ab2-150400.3.5.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"samba","fixed_in":["4.15.7+git.376.dd43aca9ab2-150400.3.5.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"ldb","fixed_in":["2.4.2-150400.4.3.11"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"samba","fixed_in":["4.15.7+git.376.dd43aca9ab2-150400.3.5.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"ldb","fixed_in":["2:2.2.3-0ubuntu0.20.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"samba","fixed_in":["2:4.13.17~dfsg-0ubuntu1.20.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ldb","fixed_in":["2.4.2-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.15.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.15.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.15.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.15.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.15.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.15.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.15.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.15.9-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.12.5-7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.16.0+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.16.0+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.16.0+dfsg-2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.12-12.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.12-11.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.12-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150300.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150300.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150300.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150300.3.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150300.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150400.4.3.11"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150400.4.3.11"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.1.15-1.1","1:1.1.16-1","1:1.1.16-1ubuntu0.1","1:1.1.24-0ubuntu0.14.04.1","1:1.1.24-0ubuntu0.14.04.2","1:1.1.24-0ubuntu0.14.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.6.18-1ubuntu3","2:4.0.10+dfsg-4ubuntu2","2:4.0.13+dfsg-1ubuntu1","2:4.1.3+dfsg-2ubuntu2","2:4.1.3+dfsg-2ubuntu3","2:4.1.3+dfsg-2ubuntu4","2:4.1.3+dfsg-2ubuntu5","2:4.1.6+dfsg-1ubuntu1","2:4.1.6+dfsg-1ubuntu2","2:4.1.6+dfsg-1ubuntu2.14.04.1","2:4.1.6+dfsg-1ubuntu2.14.04.2","2:4.1.6+dfsg-1ubuntu2.14.04.3","2:4.1.6+dfsg-1ubuntu2.14.04.4","2:4.1.6+dfsg-1ubuntu2.14.04.5","2:4.1.6+dfsg-1ubuntu2.14.04.7","2:4.1.6+dfsg-1ubuntu2.14.04.8","2:4.1.6+dfsg-1ubuntu2.14.04.9","2:4.1.6+dfsg-1ubuntu2.14.04.11","2:4.1.6+dfsg-1ubuntu2.14.04.12","2:4.1.6+dfsg-1ubuntu2.14.04.13","2:4.3.8+dfsg-0ubuntu0.14.04.2","2:4.3.9+dfsg-0ubuntu0.14.04.1","2:4.3.9+dfsg-0ubuntu0.14.04.3","2:4.3.11+dfsg-0ubuntu0.14.04.1","2:4.3.11+dfsg-0ubuntu0.14.04.2","2:4.3.11+dfsg-0ubuntu0.14.04.3","2:4.3.11+dfsg-0ubuntu0.14.04.4","2:4.3.11+dfsg-0ubuntu0.14.04.6","2:4.3.11+dfsg-0ubuntu0.14.04.7","2:4.3.11+dfsg-0ubuntu0.14.04.8","2:4.3.11+dfsg-0ubuntu0.14.04.9","2:4.3.11+dfsg-0ubuntu0.14.04.10","2:4.3.11+dfsg-0ubuntu0.14.04.11","2:4.3.11+dfsg-0ubuntu0.14.04.12","2:4.3.11+dfsg-0ubuntu0.14.04.13","2:4.3.11+dfsg-0ubuntu0.14.04.14","2:4.3.11+dfsg-0ubuntu0.14.04.16","2:4.3.11+dfsg-0ubuntu0.14.04.17","2:4.3.11+dfsg-0ubuntu0.14.04.19","2:4.3.11+dfsg-0ubuntu0.14.04.20","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm1","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm2","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm3","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm4","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm6","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm7","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm8","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm9","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm11","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm12","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm13","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm14","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm15"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.1.20-2","2:1.1.21-1","2:1.1.23-1","2:1.1.23-1ubuntu1","2:1.1.24-1ubuntu1","2:1.1.24-1ubuntu3","2:1.1.24-1ubuntu3.1","2:1.1.24-1ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.1.17+dfsg-4ubuntu2","2:4.1.20+dfsg-1ubuntu1","2:4.1.20+dfsg-1ubuntu2","2:4.1.20+dfsg-1ubuntu3","2:4.1.20+dfsg-1ubuntu5","2:4.3.3+dfsg-1ubuntu1","2:4.3.3+dfsg-1ubuntu2","2:4.3.3+dfsg-1ubuntu3","2:4.3.6+dfsg-1ubuntu1","2:4.3.8+dfsg-0ubuntu1","2:4.3.9+dfsg-0ubuntu0.16.04.1","2:4.3.9+dfsg-0ubuntu0.16.04.2","2:4.3.9+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.1","2:4.3.11+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.5","2:4.3.11+dfsg-0ubuntu0.16.04.6","2:4.3.11+dfsg-0ubuntu0.16.04.7","2:4.3.11+dfsg-0ubuntu0.16.04.8","2:4.3.11+dfsg-0ubuntu0.16.04.9","2:4.3.11+dfsg-0ubuntu0.16.04.10","2:4.3.11+dfsg-0ubuntu0.16.04.11","2:4.3.11+dfsg-0ubuntu0.16.04.12","2:4.3.11+dfsg-0ubuntu0.16.04.13","2:4.3.11+dfsg-0ubuntu0.16.04.15","2:4.3.11+dfsg-0ubuntu0.16.04.16","2:4.3.11+dfsg-0ubuntu0.16.04.17","2:4.3.11+dfsg-0ubuntu0.16.04.18","2:4.3.11+dfsg-0ubuntu0.16.04.19","2:4.3.11+dfsg-0ubuntu0.16.04.20","2:4.3.11+dfsg-0ubuntu0.16.04.21","2:4.3.11+dfsg-0ubuntu0.16.04.23","2:4.3.11+dfsg-0ubuntu0.16.04.24","2:4.3.11+dfsg-0ubuntu0.16.04.25","2:4.3.11+dfsg-0ubuntu0.16.04.26","2:4.3.11+dfsg-0ubuntu0.16.04.27","2:4.3.11+dfsg-0ubuntu0.16.04.28","2:4.3.11+dfsg-0ubuntu0.16.04.29","2:4.3.11+dfsg-0ubuntu0.16.04.30","2:4.3.11+dfsg-0ubuntu0.16.04.31","2:4.3.11+dfsg-0ubuntu0.16.04.32","2:4.3.11+dfsg-0ubuntu0.16.04.34","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm1","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm2","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm3","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.1.29-2","2:1.2.2-2","2:1.2.3-1","2:1.2.3-1ubuntu0.1","2:1.2.3-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.6.7+dfsg-1ubuntu3","2:4.7.1+dfsg-1ubuntu1","2:4.7.3+dfsg-1ubuntu1","2:4.7.4+dfsg-1ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu2","2:4.7.6+dfsg~ubuntu-0ubuntu2.2","2:4.7.6+dfsg~ubuntu-0ubuntu2.4","2:4.7.6+dfsg~ubuntu-0ubuntu2.5","2:4.7.6+dfsg~ubuntu-0ubuntu2.6","2:4.7.6+dfsg~ubuntu-0ubuntu2.7","2:4.7.6+dfsg~ubuntu-0ubuntu2.9","2:4.7.6+dfsg~ubuntu-0ubuntu2.10","2:4.7.6+dfsg~ubuntu-0ubuntu2.11","2:4.7.6+dfsg~ubuntu-0ubuntu2.13","2:4.7.6+dfsg~ubuntu-0ubuntu2.14","2:4.7.6+dfsg~ubuntu-0ubuntu2.15","2:4.7.6+dfsg~ubuntu-0ubuntu2.16","2:4.7.6+dfsg~ubuntu-0ubuntu2.17","2:4.7.6+dfsg~ubuntu-0ubuntu2.18","2:4.7.6+dfsg~ubuntu-0ubuntu2.19","2:4.7.6+dfsg~ubuntu-0ubuntu2.20","2:4.7.6+dfsg~ubuntu-0ubuntu2.21","2:4.7.6+dfsg~ubuntu-0ubuntu2.23","2:4.7.6+dfsg~ubuntu-0ubuntu2.24","2:4.7.6+dfsg~ubuntu-0ubuntu2.26","2:4.7.6+dfsg~ubuntu-0ubuntu2.27","2:4.7.6+dfsg~ubuntu-0ubuntu2.28","2:4.7.6+dfsg~ubuntu-0ubuntu2.29","2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm1","2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm2","2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.3-0ubuntu0.20.04.3"}]}],"versions":["2:1.5.5-0ubuntu2","2:1.5.5-0ubuntu3","2:2.0.7-4","2:2.0.8-1ubuntu1","2:2.0.8-2","2:2.0.10-0ubuntu0.20.04.1","2:2.0.10-0ubuntu0.20.04.2","2:2.0.10-0ubuntu0.20.04.3","2:2.2.3-0ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.13.17~dfsg-0ubuntu1.20.04.1"}]}],"versions":["2:4.10.7+dfsg-0ubuntu2","2:4.10.7+dfsg-0ubuntu3","2:4.11.1+dfsg-3ubuntu1","2:4.11.1+dfsg-3ubuntu2","2:4.11.1+dfsg-3ubuntu4","2:4.11.5+dfsg-1ubuntu1","2:4.11.5+dfsg-1ubuntu2","2:4.11.6+dfsg-0ubuntu1","2:4.11.6+dfsg-0ubuntu1.1","2:4.11.6+dfsg-0ubuntu1.2","2:4.11.6+dfsg-0ubuntu1.3","2:4.11.6+dfsg-0ubuntu1.4","2:4.11.6+dfsg-0ubuntu1.5","2:4.11.6+dfsg-0ubuntu1.6","2:4.11.6+dfsg-0ubuntu1.8","2:4.11.6+dfsg-0ubuntu1.9","2:4.11.6+dfsg-0ubuntu1.10","2:4.13.14+dfsg-0ubuntu0.20.04.1","2:4.13.14+dfsg-0ubuntu0.20.04.2","2:4.13.14+dfsg-0ubuntu0.20.04.3","2:4.13.14+dfsg-0ubuntu0.20.04.4","2:4.13.17~dfsg-0ubuntu0.21.04.1","2:4.13.17~dfsg-0ubuntu0.21.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.13.17~dfsg-0ubuntu1.20.04.1"}]}],"versions":["2:4.10.7+dfsg-0ubuntu2","2:4.10.7+dfsg-0ubuntu3","2:4.11.1+dfsg-3ubuntu1","2:4.11.1+dfsg-3ubuntu2","2:4.11.1+dfsg-3ubuntu4","2:4.11.5+dfsg-1ubuntu1","2:4.11.5+dfsg-1ubuntu2","2:4.11.6+dfsg-0ubuntu1","2:4.11.6+dfsg-0ubuntu1.1","2:4.11.6+dfsg-0ubuntu1.2","2:4.11.6+dfsg-0ubuntu1.3","2:4.11.6+dfsg-0ubuntu1.4","2:4.11.6+dfsg-0ubuntu1.5","2:4.11.6+dfsg-0ubuntu1.6","2:4.11.6+dfsg-0ubuntu1.8","2:4.11.6+dfsg-0ubuntu1.9","2:4.11.6+dfsg-0ubuntu1.10","2:4.13.14+dfsg-0ubuntu0.20.04.1","2:4.13.14+dfsg-0ubuntu0.20.04.2","2:4.13.14+dfsg-0ubuntu0.20.04.3","2:4.13.14+dfsg-0ubuntu0.20.04.4","2:4.13.17~dfsg-0ubuntu0.21.04.1","2:4.13.17~dfsg-0ubuntu0.21.04.2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.9+dfsg-0ubuntu0.2"}]}],"versions":["2:4.13.5+dfsg-2ubuntu2","2:4.13.5+dfsg-2ubuntu3","2:4.13.14+dfsg-0ubuntu1","2:4.13.14+dfsg-0ubuntu2","2:4.15.5~dfsg-0ubuntu1","2:4.15.5~dfsg-0ubuntu2","2:4.15.5~dfsg-0ubuntu4","2:4.15.5~dfsg-0ubuntu5","2:4.15.5~dfsg-0ubuntu5.1"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-1.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"storage"},{"vendor":"samba","product":"samba"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077533","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://bugzilla.samba.org/show_bug.cgi?id=14694","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix"]},{"url":"https://gitlab.com/samba-team/samba/-/commit/1d5b155619bc532c46932965b215bd73a920e56f","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://gitlab.com/samba-team/samba/-/commit/dcfcafdbf756e12d9077ad7920eea25478c29f81","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://gitlab.com/samba-team/samba/-/commit/86fe9d48883f87c928bf31ccbd275db420386803","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://gitlab.com/samba-team/samba/-/commit/e1ab0c43629686d1d2c0b0b2bcdc90057a792049","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://gitlab.com/samba-team/samba/-/commit/2b3af3b560c9617a233c131376c870fce146c002","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://gitlab.com/samba-team/samba/-/commit/5f0590362c5c0c5ee20503a67467f9be2d50e73b","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://gitlab.com/samba-team/samba/-/commit/3507e96b3dcf0c0b8eff7b2c08ffccaf0812a393","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/202309-06","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3670","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-p9j9-qqwf-j574"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-3670","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3670","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1735","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1703","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221576-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198397","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3670","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222307-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1080338","tags":["report"]},{"url":"https://bugzilla.suse.com/1118508","tags":["report"]},{"url":"https://bugzilla.suse.com/1173429","tags":["report"]},{"url":"https://bugzilla.suse.com/1195896","tags":["report"]},{"url":"https://bugzilla.suse.com/1196224","tags":["report"]},{"url":"https://bugzilla.suse.com/1196308","tags":["report"]},{"url":"https://bugzilla.suse.com/1196788","tags":["report"]},{"url":"https://bugzilla.suse.com/1197995","tags":["report"]},{"url":"https://bugzilla.suse.com/1198255","tags":["report"]},{"url":"https://bugzilla.suse.com/1199247","tags":["report"]},{"url":"https://bugzilla.suse.com/1199362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3670","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5542-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3670","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-2031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32746","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-3670","description":"MaxQueryDuration not honoured in Samba AD DC LDAP","status":"published","published":"2022-08-23T15:50:25Z","modified":"2025-02-13T16:28:26.347Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26962","description":"MaxQueryDuration not honoured in Samba AD DC LDAP","status":"published","published":"2022-08-23T15:50:25Z","modified":"2025-02-13T16:28:26Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"none"}],"updated_at":"2026-11-03T00:03:52.752782Z"}],"ghsa":[{"id":"GHSA-p9j9-qqwf-j574","title":"MaxQueryDuration not honoured in Samba AD DC LDAP","description":"MaxQueryDuration not honoured in Samba AD DC LDAP","status":"published","published":"2022-08-24T00:00:29Z","modified":"2023-09-17T09:30:18Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:54:46.481792Z"}],"nvd":[{"id":"CVE-2021-3670","description":"MaxQueryDuration not honoured in Samba AD DC LDAP","status":"published","published":"2022-08-23T16:15:09.393Z","modified":"2026-06-17T04:05:32.31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"ALPINE-CVE-2021-3670","description":"MaxQueryDuration not honoured in Samba AD DC LDAP","status":"published","published":"2022-08-23T16:15:09.393Z","modified":"2026-10-23T17:17:56.200736285Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-10662","title":"CVE-2021-3670 affecting package samba 4.12.5-7","description":"MaxQueryDuration not honoured in Samba AD DC LDAP","status":"published","published":"2022-08-23T16:15:09Z","modified":"2026-04-21T04:21:20.016068Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"CVE-2021-3670","description":"MaxQueryDuration not honoured in Samba AD DC LDAP","status":"published","published":"2022-08-23T16:15:09.393Z","modified":"2026-11-08T13:15:11.992667692Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2021-3670","description":"MaxQueryDuration not honoured in Samba AD DC LDAP","status":"published","published":"2022-08-23T16:15:09.393Z","modified":"2026-10-23T18:03:29.735634639Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2022-1735","title":"samba security update","description":"Samba is a suite of programs for Linux and Unix to interoperate with Windows.\r\n\r\nSecurity Fix(es):\r\n\r\nMaxQueryDuration not honoured in Samba AD DC LDAP(CVE-2021-3670)","status":"published","published":"2022-07-01T11:05:00Z","modified":"2026-08-18T01:16:47.355760655Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2024-1703","title":"libldb security update","description":"An extensible library that implements an LDAP like API to access remote LDAP servers, or use local tdb databases.\r\n\r\nSecurity Fix(es):\r\n\r\nMaxQueryDuration not honoured in Samba AD DC LDAP(CVE-2021-3670)","status":"published","published":"2024-06-07T11:07:10Z","modified":"2026-08-18T01:17:23.650116312Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"UBUNTU-CVE-2021-3670","description":"MaxQueryDuration not honoured in Samba AD DC LDAP","status":"published","published":"2021-12-31T00:00:00Z","modified":"2026-04-22T12:57:48.292561Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"openSUSE-SU-2024:11882-1","title":"ldb-tools-2.4.2-1.1 on GA media","description":"These are all security issues fixed in the ldb-tools-2.4.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:31:55.507453Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:1576-1","title":"Security update for ldb","description":"This update for ldb fixes the following issues:\n\n- Update to version 2.4.2\n  - CVE-2021-3670: Fixed an issue where the LDAP server MaxQueryDuration value\n    would not be honoured (bsc#1198397).\n","status":"published","published":"2022-05-09T11:44:54Z","modified":"2026-02-04T02:55:22.813313Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2307-1","title":"Security update for ldb, samba","description":"This update for ldb, samba fixes the following issues:\n\nldb was updated to version 2.4.2 to fix:\n\n+ Fix for CVE-2021-3670, ensure that the LDB request has not\n  timed out during filter processing as the LDAP server\n  MaxQueryDuration is otherwise not honoured.\n\nsamba was updated to fix:\n\n- Revert NIS support removal; (bsc#1199247);\n\n- Use requires_eq macro to require the libldb2 version available at\n  samba-dsdb-modules build time; (bsc#1199362);\n\n- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);\n\nUpdate to 4.15.7\n\n* Share and server swapped in smbget password prompt; (bso#14831);\n* Durable handles won't reconnect if the leased file is written\n  to; (bso#15022);\n* rmdir silently fails if directory contains unreadable files and\n  hide unreadable is yes; (bso#15023);\n* SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information\n  on renamed file handle; (bso#15038);\n* vfs_shadow_copy2 breaks 'smbd async dosmode' sync fallback;\n  (bso#14957);\n* shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;\n  (bso#15035);\n* PAM Kerberos authentication incorrectly fails with a clock skew\n  error; (bso#15046);\n* username map - samba erroneously applies unix group memberships\n  to user account entries; (bso#15041);\n* NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES\n  in SMBC_server_internal; (bso#14983);\n* Simple bind doesn't work against an RODC (with non-preloaded users);\n  (bso#13879);\n* Crash of winbind on RODC; (bso#14641);\n* uncached logon on RODC always fails once; (bso#14865);\n* KVNO off by 100000; (bso#14951);\n* LDAP simple binds should honour 'old password allowed period';\n  (bso#15001);\n* wbinfo -a doesn't work reliable with upn names; (bso#15003);\n* Simple bind doesn't work against an RODC (with non-preloaded\n  users); (bso#13879);\n* Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);\n* Regression: create krb5 conf = yes doesn't work with a single KDC;\n  (bso#15016);\n\n- Add provides to samba-client-libs package to fix upgrades from\n  previous versions; (bsc#1197995);\n\n- Add missing samba-libs requirement to samba-winbind package;\n  (bsc#1198255);\n\nUpdate to 4.15.6\n\n* Renaming file on DFS root fails with\n  NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);\n* Samba does not response STATUS_INVALID_PARAMETER when opening 2\n  objects with same lease key; (bso#14737);\n* NT error code is not set when overwriting a file during rename\n  in libsmbclient; (bso#14938);\n* Fix ldap simple bind with TLS auditing; (bso#14996);\n* net ads info shows LDAP Server: 0.0.0.0 depending on contacted\n  server; (bso#14674);\n* Problem when winbind renews Kerberos; (bso#14979);\n  (bsc#1196224);\n* pam_winbind will not allow gdm login if password about to\n  expire; (bso#8691);\n* virusfilter_vfs_openat: Not scanned: Directory or special file;\n  (bso#14971);\n* DFS fix for AIX broken; (bso#13631);\n* Solaris and AIX acl modules: wrong function arguments;\n  (bso#14974);\n* Function aixacl_sys_acl_get_file not declared / coredump;\n  (bso#7239);\n* Regression: Samba 4.15.2 on macOS segfaults intermittently\n  during strcpy in tdbsam_getsampwnam; (bso#14900);\n* Fix a use-after-free in SMB1 server; (bso#14989);\n* smb2_signing_decrypt_pdu() may not decrypt with\n  gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;\n  (bso#14968);\n* Changing the machine password against an RODC likely destroys\n  the domain join; (bso#14984);\n* authsam_make_user_info_dc() steals memory from its struct\n  ldb_message *msg argument; (bso#14993);\n* Use Heimdal 8.0 (pre) rather than an earlier snapshot;\n  (bso#14995);\n* Samba autorid fails to map AD users if id rangesize fits in the\n  id range only once; (bso#14967);\n\nOther SUSE fixes:\n\n- Fix mismatched version of libldb2; (bsc#1196788).\n- Drop obsolete SuSEfirewall2 service files.\n- Drop obsolete Samba fsrvp v0-\u003ev1 state upgrade functionality; (bsc#1080338).\n- Fix ntlm authentications with 'winbind use default domain = yes';\n  (bso#13126); (bsc#1173429); (bsc#1196308).\n- Fix samba-ad-dc status warning notification message by disabling\n  systemd notifications in bgqd; (bsc#1195896); (bso#14947).\n- libldb version mismatch in Samba dsdb component; (bsc#1118508);\n","status":"published","published":"2022-07-06T12:04:27Z","modified":"2026-02-04T04:11:09.460576Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5542-1","title":"samba vulnerabilities","description":"It was discovered that Samba did not handle MaxQueryDuration when being\nused in AD DC configurations, contrary to expectations. This issue only\naffected Ubuntu 20.04 LTS. (CVE-2021-3670)\n\nLuke Howard discovered that Samba incorrectly handled certain restrictions\nassociated with changing passwords. A remote attacker being requested to\nchange passwords could possibly use this issue to escalate privileges.\n(CVE-2022-2031)\n\nLuca Moro discovered that Samba incorrectly handled certain SMB1\ncommunications. A remote attacker could possibly use this issue to obtain\nsensitive memory contents. (CVE-2022-32742)\n\nJoseph Sutton discovered that Samba incorrectly handled certain password\nchange requests. A remote attacker could use this issue to change passwords\nof other users, resulting in privilege escalation. (CVE-2022-32744)\n\nJoseph Sutton discovered that Samba incorrectly handled certain LDAP add or\nmodify requests. A remote attacker could possibly use this issue to cause\nSamba to crash, resulting in a denial of service. (CVE-2022-32745)\n\nJoseph Sutton and Andrew Bartlett discovered that Samba incorrectly handled\ncertain LDAP add or modify requests. A remote attacker could possibly use\nthis issue to cause Samba to crash, resulting in a denial of service.\n(CVE-2022-32746)\n","status":"published","published":"2022-08-01T11:50:53Z","modified":"2026-04-27T16:15:01.584186Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}