{"id":"CVE-2025-0620","aliases":["ALPINE-CVE-2025-0620","CLSA-2026-1778859875","DEBIAN-CVE-2025-0620","EUVD-2025-17307","GHSA-8q8w-8225-6gq4","SUSE-SU-2025:02230-1","UBUNTU-CVE-2025-0620","USN-7564-1","openSUSE-SU-2025:15296-1"],"status":"published","title":"Samba: smbd doesn't pick up group membership changes when re-authenticating an expired smb session","description":"A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00802,"percentile":0.56921,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-552"],"published":"2025-06-03T00:00:00Z","modified":"2026-11-05T14:46:08Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"samba","fixed_in":["4.21.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"samba","fixed_in":["4.21.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"samba","fixed_in":["4.21.6-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"ctdb","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"ldb-tools","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libldb","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libldb-devel","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libnetapi","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libnetapi-devel","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsmbclient","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsmbclient-devel","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libwbclient","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libwbclient-devel","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-ldb","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-samba","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-samba-dc","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-samba-test","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-client","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-client-libs","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-common","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-common-libs","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-common-tools","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-dc-libs","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-dcerpc","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-devel","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-gpupdate","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-krb5-printing","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-ldb-ldap-modules","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-libs","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-pidl","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-test","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-test-libs","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-tools","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-usershares","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-vfs-iouring","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-winbind","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-winbind-clients","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-winbind-krb5-locator","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-winbind-modules","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-winexe","fixed_in":["4.21.3-14.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"samba","fixed_in":["2:4.22.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"samba","fixed_in":["2:4.22.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"samba","fixed_in":["4.21.6+git.402.80f493f530f-150700.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"samba","fixed_in":["4.21.6+git.402.80f493f530f-150700.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.04","package":"samba","fixed_in":["2:4.21.4+dfsg-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"samba","fixed_in":["4.22.2+git.396.c752843dcf4-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.21.0"},{"fixed":"4.21.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.21.0"},{"fixed":"4.21.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.21.0"},{"fixed":"4.21.6-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ctdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ldb-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libldb-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libnetapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libnetapi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsmbclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsmbclient-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libwbclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libwbclient-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-samba-dc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-samba-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-client-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-common-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-dc-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-dcerpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-gpupdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-krb5-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-ldb-ldap-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-pidl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-test-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-usershares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-vfs-iouring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-winbind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-winbind-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-winbind-krb5-locator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-winbind-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"samba-winexe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.3-14.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.22.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.22.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.6+git.402.80f493f530f-150700.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.6+git.402.80f493f530f-150700.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:25.04","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.21.4+dfsg-1ubuntu3.1"}]}],"versions":["2:4.20.4+dfsg-1ubuntu1","2:4.20.4+dfsg-1ubuntu2","2:4.20.4+dfsg-1ubuntu3","2:4.20.4+dfsg-1ubuntu5","2:4.21.4+dfsg-1ubuntu2","2:4.21.4+dfsg-1ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.22.2+git.396.c752843dcf4-1.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"samba","product":"samba"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-0620","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2370453","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report"]},{"url":"https://www.samba.org/samba/security/CVE-2025-0620.html","tags":["Vendor Advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/06/03/8","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0620","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8q8w-8225-6gq4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-0620","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1778859875.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://www.samba.org/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0620.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-0620","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502230-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1238063","tags":["report"]},{"url":"https://bugzilla.suse.com/1244136","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0620","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-0620","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-0620","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7564-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-0620","title":"Samba: smbd doesn't pick up group membership changes when re-authenticating an expired smb session","description":"A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.","status":"published","published":"2025-06-06T13:10:07.11Z","modified":"2026-11-05T14:46:08.798Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-552"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2025-17307","description":"A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.","status":"published","published":"2025-06-06T13:10:07Z","modified":"2026-11-05T14:46:08Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T16:59:57.067043Z"}],"ghsa":[{"id":"GHSA-8q8w-8225-6gq4","title":"A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when...","description":"A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.","status":"published","published":"2025-06-06T15:30:53Z","modified":"2025-06-06T15:31:01Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T15:02:36.716366Z"}],"nvd":[{"id":"CVE-2025-0620","description":"A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.","status":"published","published":"2025-06-06T14:15:21.247Z","modified":"2026-11-05T15:17:06.207Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-552"],"updated_at":"2026-11-05T19:55:50.758755Z"}],"osv":[{"id":"ALPINE-CVE-2025-0620","description":"A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.","status":"published","published":"2025-06-06T14:15:21.247Z","modified":"2026-08-27T22:18:02.75194038Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"CVE-2025-0620","title":"Samba: smbd doesn't pick up group membership changes when re-authenticating an expired smb session","description":"A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.","status":"published","published":"2025-06-06T13:10:07.11Z","modified":"2026-11-07T02:31:11.16988596Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-552"],"updated_at":"2026-11-07T03:07:55.264406Z"},{"id":"DEBIAN-CVE-2025-0620","description":"A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.","status":"published","published":"2025-06-06T14:15:21.247Z","modified":"2026-09-01T20:05:39.917795149Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"UBUNTU-CVE-2025-0620","description":"A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.","status":"withdrawn","published":"2025-06-03T00:00:00Z","modified":"2026-02-04T03:20:45.475023Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"CLSA-2026-1778859875","title":"samba: Fix of CVE-2025-0620","description":"- Fix CVE-2025-0620: smbd doesn't pick up group membership changes\n  when re-authenticating an expired SMB session.","status":"published","published":"2026-05-15T15:44:39Z","modified":"2026-06-01T00:32:52.527228239Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"openSUSE-SU-2025:15296-1","title":"ctdb-4.22.2+git.396.c752843dcf4-1.1 on GA media","description":"These are all security issues fixed in the ctdb-4.22.2+git.396.c752843dcf4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:36.204639Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:02230-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\n- CVE-2025-0620: smbd doesn't pick up group membership changes when re-authenticating an expired SMB session (bsc#1244136).\n\nOther bugfixes:\n\n- net ad join fails with 'Failed to join domain: failed to create kerberos keytab' (bsc#1238063).\n","status":"published","published":"2025-07-04T16:03:18Z","modified":"2026-03-23T04:48:32.138405Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"USN-7564-1","title":"samba vulnerability","description":"It was discovered that Samba incorrectly handled certain group membership\nchanges when using Kerberos authentication. A remote user could possibly\nuse this issue to continue to access resources after being removed by an\nadministrator.\n","status":"published","published":"2025-06-10T13:30:31.459453Z","modified":"2026-01-14T03:30:28.146788Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}