CVE-2020-25719: canonical ubuntu_linux Improper Authentication

Modified

AliasesALPINE-CVE-2020-25719RHSA-2021:5142RHSA-2021:5195+4 more

Published 18-02-2022Last modified 04-08-2024

Vulnerability summary

CVE-2020-25719 is a high (CVSS 9.0) Improper Authentication vulnerability in canonical ubuntu_linux. EPSS estimates a 1.69% chance of exploitation in the next 30 days, higher than 77.1% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.2, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

9.0/10

010

High · v2.0 (NVD)

EPSS score

1.69%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 5

DSA-5003-1 MGASA-2021-0585 OPENSUSE-SU-2021:3647-1 OPENSUSE-SU-2024:11631-1 SUSE-SU-2021:3647-1 SUSE-SU-2022:0361-1+1 more

Timeline

18-02-2022
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.17.2v2.09.0

EPSS trend

Probability

1.69%

Chance of exploitation in the next 30 days

Percentile

77%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.69% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat67 products

enterprise_linuxEOL7.0 | 8.0
enterprise_linux_desktop7.0
enterprise_linux_eus8.2 | 8.4
enterprise_linux_for_ibm_z_systems7.0 | 8.0
enterprise_linux_for_ibm_z_systems_eus8.2 | 8.4

enterprise_linux_for_power_big_endian7.0
enterprise_linux_for_power_little_endian7.0 | 8.0
enterprise_linux_for_power_little_endian_eus8.2 | 8.4
enterprise_linux_for_scientific_computing7.0
enterprise_linux_server_aus8.2 | 8.4
enterprise_linux_server_tus8.2 | 8.4
enterprise_linux_server_update_services_for_sap_solutions8.2 | 8.4
enterprise_linux_workstation7.0
bind-dyndb-ldap< 0:11.6-2.module+el8.4.0+9328+4ec4e316 | < 0:11.2-3.module+el8.2.0+4921+923e30d5
bind-dyndb-ldap-debuginfo< 0:11.6-2.module+el8.4.0+9328+4ec4e316 | < 0:11.2-3.module+el8.2.0+4921+923e30d5
bind-dyndb-ldap-debugsource< 0:11.6-2.module+el8.4.0+9328+4ec4e316 | < 0:11.2-3.module+el8.2.0+4921+923e30d5
custodia< 0:0.6.0-3.module+el8.1.0+4098+f286395e
ipa< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.6.8-5.el7_9.10 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
ipa-client< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.6.8-5.el7_9.10 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
ipa-client-common< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.6.8-5.el7_9.10 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
ipa-client-debuginfo< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
ipa-client-epn< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.9.2-6.module+el8.4.0+13654+33612214
ipa-client-samba< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
ipa-common< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.6.8-5.el7_9.10 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
ipa-debuginfo< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.6.8-5.el7_9.10 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
ipa-debugsource< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
ipa-healthcheck< 0:0.7-6.module+el8.5.0+11410+91a33fe4 | < 0:0.7-3.module+el8.4.0+9007+5084bdd8 | < 0:0.4-4.module+el8.2.0+5489+95477d9f
ipa-healthcheck-core< 0:0.7-6.module+el8.5.0+11410+91a33fe4 | < 0:0.7-3.module+el8.4.0+9007+5084bdd8 | < 0:0.4-4.module+el8.2.0+5489+95477d9f
ipa-idoverride-memberof< 0:0.0.4-6.module+el8.1.0+4098+f286395e
ipa-idoverride-memberof-plugin< 0:0.0.4-6.module+el8.1.0+4098+f286395e
ipa-python-compat< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.6.8-5.el7_9.10 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
ipa-selinux< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.9.2-6.module+el8.4.0+13654+33612214
ipa-server< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.6.8-5.el7_9.10 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
ipa-server-common< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.6.8-5.el7_9.10 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
ipa-server-debuginfo< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
ipa-server-dns< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.6.8-5.el7_9.10 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
ipa-server-trust-ad< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.6.8-5.el7_9.10 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
ipa-server-trust-ad-debuginfo< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
opendnssec< 0:2.1.7-1.module+el8.4.0+9007+5084bdd8 | < 0:1.4.14-1.module+el8.1.0+4098+f286395e
opendnssec-debuginfo< 0:2.1.7-1.module+el8.4.0+9007+5084bdd8 | < 0:1.4.14-1.module+el8.1.0+4098+f286395e
opendnssec-debugsource< 0:2.1.7-1.module+el8.4.0+9007+5084bdd8 | < 0:1.4.14-1.module+el8.1.0+4098+f286395e
python-jwcrypto< 0:0.5.0-1.module+el8.1.0+4098+f286395e
python-kdcproxy< 0:0.4-5.module+el8.2.0+4691+a05b2456
python-qrcode< 0:5.1-12.module+el8.1.0+4098+f286395e
python-yubico< 0:1.3.2-9.module+el8.1.0+4098+f286395e
python2-ipaclient< 0:4.6.8-5.el7_9.10
python2-ipalib< 0:4.6.8-5.el7_9.10
python2-ipaserver< 0:4.6.8-5.el7_9.10
python3-custodia< 0:0.6.0-3.module+el8.1.0+4098+f286395e
python3-ipaclient< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
python3-ipalib< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
python3-ipaserver< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.9.2-6.module+el8.4.0+13654+33612214 | < 0:4.8.4-12.module+el8.2.0+13684+242c9723
python3-ipatests< 0:4.9.6-10.module+el8.5.0+13587+92118e57 | < 0:4.9.2-6.module+el8.4.0+13654+33612214
python3-jwcrypto< 0:0.5.0-1.module+el8.1.0+4098+f286395e
python3-kdcproxy< 0:0.4-5.module+el8.2.0+4691+a05b2456
python3-pyusb< 0:1.0.0-9.module+el8.1.0+4098+f286395e
python3-qrcode< 0:5.1-12.module+el8.1.0+4098+f286395e
python3-qrcode-core< 0:5.1-12.module+el8.1.0+4098+f286395e
python3-yubico< 0:1.3.2-9.module+el8.1.0+4098+f286395e
pyusb< 0:1.0.0-9.module+el8.1.0+4098+f286395e
slapi-nis< 0:0.56.6-4.module+el8.5.0+12583+bf7ffcf6 | < 0:0.56.6-2.1.module+el8.4.0+12579+0538eac8 | < 0:0.56.3-3.module+el8.2.0+13684+242c9723
slapi-nis-debuginfo< 0:0.56.6-4.module+el8.5.0+12583+bf7ffcf6 | < 0:0.56.6-2.1.module+el8.4.0+12579+0538eac8 | < 0:0.56.3-3.module+el8.2.0+13684+242c9723
slapi-nis-debugsource< 0:0.56.6-4.module+el8.5.0+12583+bf7ffcf6 | < 0:0.56.6-2.1.module+el8.4.0+12579+0538eac8 | < 0:0.56.3-3.module+el8.2.0+13684+242c9723
softhsm< 0:2.6.0-5.module+el8.4.0+10227+076cd560 | < 0:2.4.0-4.module+el8.2.0+5779+a38c524f
softhsm-debuginfo< 0:2.6.0-5.module+el8.4.0+10227+076cd560 | < 0:2.4.0-4.module+el8.2.0+5779+a38c524f
softhsm-debugsource< 0:2.6.0-5.module+el8.4.0+10227+076cd560 | < 0:2.4.0-4.module+el8.2.0+5779+a38c524f
softhsm-devel< 0:2.6.0-5.module+el8.4.0+10227+076cd560 | < 0:2.4.0-4.module+el8.2.0+5779+a38c524f

Show all 67

Debian2 products

samba< 2:4.13.14+dfsg-1
debian_linuxEOL9.0 | 10.0

Alpine1 product

samba≥ 4.0.0, < 4.13.17-r0 | ≥ 4.0.0, < 4.14.12-r0 | ≥ 4.0.0, < 4.15.2-r0

Canonical1 product

ubuntu_linuxEOL20.04 | 21.04 | 21.10

Fedoraproject1 product

fedoraEOL33 | 34 | 35

Samba1 product

samba≥ 4.0.0, < 4.13.14 | ≥ 4.14.0, < 4.14.10 | ≥ 4.15.0, < 4.15.2

Ubuntu1 product

sambaAll versions (No fix recorded) | < 2:4.13.14+dfsg-0ubuntu0.20.04.1 | < 2:4.13.14+dfsg-0ubuntu1

7 vendors · 74 products

References

21 links

bugzilla.redhat.com/show_bug.cgi?id=2019732REPORTIssue TrackingPatchThird Party Advisory
www.samba.org/samba/security/CVE-2020-25719.htmlARTICLEREPORTMitigationVendor Advisory
security.gentoo.org/glsa/202309-06Vendor Advisory
security.alpinelinux.org/vuln/CVE-2020-25719Advisory
access.redhat.com/errata/RHSA-2021:5142Advisory
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/security/cve/CVE-2020-25719REPORT
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5142.jsonAdvisory
www.cve.org/CVERecord?id=CVE-2020-25719AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2020-25719AdvisoryOval

Show all 21 references