CVE-2019-14907
(In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).
Does this matter?
Lower severity and a low EPSS score (3.15%). Track it; it rarely justifies an emergency change on its own.
Description
All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 3.15% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-125
- Affected
- samba/samba · fedoraproject/fedora · redhat/storage · redhat/enterprise linux · canonical/ubuntu linux · synology/directory server · synology/router manager · synology/skynas · synology/diskstation manager · debian/debian linux
- Source
- secalert@redhat.com
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00055.htmlThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14907Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/05/msg00023.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ACZVNMIFQGGXNJPMHAVBN3H2U65FXQY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GQ6U65I2K23YJC4FESW477WL55TU3PPT/
- https://security.gentoo.org/glsa/202003-52Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200122-0001/Third Party Advisory
- https://usn.ubuntu.com/4244-1/Third Party Advisory
- https://www.samba.org/samba/security/CVE-2019-14907.htmlVendor Advisory
- https://www.synology.com/security/advisory/Synology_SA_20_01Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00055.htmlThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14907Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/05/msg00023.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ACZVNMIFQGGXNJPMHAVBN3H2U65FXQY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GQ6U65I2K23YJC4FESW477WL55TU3PPT/
- https://security.gentoo.org/glsa/202003-52Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200122-0001/Third Party Advisory
- https://usn.ubuntu.com/4244-1/Third Party Advisory
- https://www.samba.org/samba/security/CVE-2019-14907.htmlVendor Advisory
- https://www.synology.com/security/advisory/Synology_SA_20_01Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.