The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade samba | Mar 21, 2024 | Apr 3, 2023 |
| Amazon_linux_2023 | — | Upgrade samba-winbind-clientsUpgrade python3-samba-testUpgrade samba-krb5-printing-debuginfoUpgrade samba-dc-libsUpgrade samba-client-libs-debuginfoUpgrade samba-common-toolsUpgrade samba-winbind-krb5-locatorUpgrade libsmbclientUpgrade samba-winbind-modulesUpgrade samba-vfs-iouring-debuginfoUpgrade python3-ldbUpgrade samba-clientUpgrade samba-client-debuginfoUpgrade samba-libs-debuginfoUpgrade samba-test-libsUpgrade samba-dcerpcUpgrade samba-winbind-debuginfoUpgrade samba-winbind-krb5-locator-debuginfoUpgrade samba-winbind-clients-debuginfoUpgrade libldb-develUpgrade libsmbclient-develUpgrade python3-samba-debuginfoUpgrade samba-common-libsUpgrade samba-libsUpgrade libnetapiUpgrade samba-ldb-ldap-modules-debuginfoUpgrade python-ldb-devel-commonUpgrade samba-debugsourceUpgrade python3-ldb-debuginfoUpgrade samba-common-libs-debuginfoUpgrade python3-samba-dc-debuginfoUpgrade ldb-tools-debuginfoUpgrade libsmbclient-debuginfoUpgrade ldb-toolsUpgrade python3-ldb-develUpgrade libldbUpgrade python3-sambaUpgrade libwbclientUpgrade samba-debuginfoUpgrade samba-dcerpc-debuginfoUpgrade samba-toolsUpgrade libldb-debuginfoUpgrade samba-test-libs-debuginfoUpgrade python3-samba-dcUpgrade samba-client-libsUpgrade samba-vfs-iouringUpgrade sambaUpgrade python3-samba-develUpgrade samba-krb5-printingUpgrade samba-common-tools-debuginfoUpgrade samba-commonUpgrade libwbclient-develUpgrade libnetapi-develUpgrade libldb-debugsourceUpgrade samba-pidlUpgrade samba-dc-libs-debuginfoUpgrade samba-test-debuginfoUpgrade samba-winbindUpgrade samba-usersharesUpgrade samba-develUpgrade libwbclient-debuginfoUpgrade libnetapi-debuginfoUpgrade samba-ldb-ldap-modulesUpgrade samba-testUpgrade samba-winbind-modules-debuginfo | Feb 17, 2025 | Mar 29, 2023 |
| Debian | — | Upgrade samba | Jul 30, 2024 | Apr 3, 2023 |
| Freebsd | — | Upgrade samba417Upgrade samba418Upgrade samba416 | Apr 14, 2023 | Apr 7, 2023 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Sep 18, 2023 | Apr 3, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libldb | Jan 10, 2024 | Apr 3, 2023 |
| Samba | — | Upgrade to Samba 4.16.10 or later.Upgrade to Samba 4.17.7 or later.Upgrade to Samba 4.18.1 or later. | Apr 27, 2023 | Apr 3, 2023 |
| Suse | — | Upgrade libsamba-policy-develUpgrade libsamba-policy-python3-develUpgrade samba-winbindUpgrade samba-ad-dc-libs-32bitUpgrade sambaUpgrade samba-client-32bitUpgrade python3-ldbUpgrade samba-ad-dc-libsUpgrade samba-winbind-libs-32bitUpgrade samba-docUpgrade python3-ldb-develUpgrade samba-libs-python3-32bitUpgrade libldb-develUpgrade samba-toolUpgrade libldb2Upgrade ctdb-pcp-pmdaUpgrade samba-ad-dcUpgrade samba-clientUpgrade samba-cephUpgrade libsamba-policy0-python3-32bitUpgrade libsamba-policy0-python3Upgrade samba-develUpgrade samba-python3Upgrade ldb-toolsUpgrade samba-libs-32bitUpgrade samba-client-libs-32bitUpgrade samba-devel-32bitUpgrade samba-libs-python3Upgrade samba-testUpgrade samba-winbind-libsUpgrade samba-gpupdateUpgrade samba-libsUpgrade libldb2-32bitUpgrade samba-ldb-ldapUpgrade python3-ldb-32bitUpgrade ctdbUpgrade samba-dsdb-modulesUpgrade samba-client-libs | Mar 30, 2023 | Mar 29, 2023 |
| Ubuntu | — | Upgrade sambaUpgrade libldb2 | Apr 10, 2023 | Apr 3, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub