p PatchFirst

CVE-2021-23192

CVE-2021-23192

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements.

CVSS 7.5 · High · EPSS 2.0% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • samba

    Versions
    • Affects samba v4.10.0 to 4.15.1, Fixed in samba v4.15.2, v4.14.10 and v4.13.14.: Affected

    No fix published

  • samba Debian:12

    Affected ranges
    • ECOSYSTEM: < 2:4.13.14+dfsg-1

    Update to 2:4.13.14+dfsg-1

  • samba Debian:13

    Affected ranges
    • ECOSYSTEM: < 2:4.13.14+dfsg-1

    Update to 2:4.13.14+dfsg-1

  • samba Debian:14

    Affected ranges
    • ECOSYSTEM: < 2:4.13.14+dfsg-1

    Update to 2:4.13.14+dfsg-1

  • samba Ubuntu:20.04:LTS

    Versions
    • 2:4.10.7+dfsg-0ubuntu2
    • 2:4.10.7+dfsg-0ubuntu3
    • 2:4.11.1+dfsg-3ubuntu1
    • 2:4.11.1+dfsg-3ubuntu2
    • 2:4.11.1+dfsg-3ubuntu4
    • 2:4.11.5+dfsg-1ubuntu1
    • 2:4.11.5+dfsg-1ubuntu2
    • 2:4.11.6+dfsg-0ubuntu1
    • 2:4.11.6+dfsg-0ubuntu1.1
    • 2:4.11.6+dfsg-0ubuntu1.2
    • 2:4.11.6+dfsg-0ubuntu1.3
    • 2:4.11.6+dfsg-0ubuntu1.4
    • 2:4.11.6+dfsg-0ubuntu1.5
    • 2:4.11.6+dfsg-0ubuntu1.6
    • 2:4.11.6+dfsg-0ubuntu1.8
    • 2:4.11.6+dfsg-0ubuntu1.9
    • 2:4.11.6+dfsg-0ubuntu1.10
    Affected ranges
    • ECOSYSTEM: < 2:4.13.14+dfsg-0ubuntu0.20.04.1

    Update to 2:4.13.14+dfsg-0ubuntu0.20.04.1

  • samba Ubuntu:22.04:LTS

    Versions
    • 2:4.13.5+dfsg-2ubuntu2
    • 2:4.13.5+dfsg-2ubuntu3
    Affected ranges
    • ECOSYSTEM: < 2:4.13.14+dfsg-0ubuntu1

    Update to 2:4.13.14+dfsg-0ubuntu1

Original sources

Check your server →