CVE-2019-14870: canonical ubuntu_linux Improper Authorization
Vulnerability summary
CVE-2019-14870 is a medium (CVSS 6.4) Improper Authorization vulnerability in canonical ubuntu_linux. EPSS estimates a 2.67% chance of exploitation in the next 30 days, higher than 85.8% of scored vulnerabilities.
Not severe (CVSS 5.4, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 9Timeline
- 10-12-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set.
CVSS metrics
8 scores · 5 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- NVDNIST5.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
2.67%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
Decrease -0.11 pp
From 2.78% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian3 products
- heimdal< 7.7.0+dfsg-1
- samba< 2:4.11.3+dfsg-1
- debian_linuxEOL9.0 | 10.0
Alpine2 products
- heimdal< 7.7.1-r0
- samba≥ 4.0.0, < 4.10.11-r0 | ≥ 4.0.0, < 4.11.3-r0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 19.04 | 19.10
Fedoraproject1 product
- fedoraEOL30 | 31
Opensuse1 product
- leapEOL15.1
Red hat1 product
- sambaall versions 4.11.x before 4.11.3 | all versions 4.10.x before 4.10.11 | all versions 4.x.x before 4.9.17
Samba1 product
- samba≥ 4.0.0, < 4.9.17 | ≥ 4.10.0, < 4.10.11 | ≥ 4.11.0, < 4.11.3
Ubuntu1 product
- samba< 2:4.3.11+dfsg-0ubuntu0.14.04.20+esm4 | < 2:4.3.11+dfsg-0ubuntu0.16.04.24 | < 2:4.7.6+dfsg~ubuntu-0ubuntu2.14
8 vendors · 11 products
References
20 links- security.netapp.com/advisory/ntap-20191210-0002/Third Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- www.synology.com/security/advisory/Synology_SA_19_40Third Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.htmlVendor AdvisoryMailing ListThird Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
Show all 20 references
- security.gentoo.org/glsa/202310-06Vendor Advisory