CVE-2023-0614: samba
CVSS: 7.7v3.1HighModified
AliasesUBUNTU-CVE-2023-0614USN-5992-1DEBIAN-CVE-2023-0614openSUSE-SU-2024:12830-1
Published 03-04-2023Last modified 13-02-2025
Vulnerability summary
CVE-2023-0614 is a high (CVSS 7.7) vulnerability in samba. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.2% of scored vulnerabilities.
CVSS score
7.7/10
010
High · v3.1 (CVE.org)EPSS score
0.57%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 4Timeline
- 03-04-2023PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.
CVSS metrics
4 scores · 4 sources · 1 versionHigh 7.7Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NSources4 sources · 6.5–7.7
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.57%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
0.00 pp
From 0.57% on 20-09-2026
20-09-202620-10-2026
EPSS score0.57%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Affected systems
Ubuntu2 products
- ldbAll versions (No fix recorded) | < 2:2.4.4-0ubuntu0.20.04.2 | < 2:2.4.4-0ubuntu0.22.04.2
- sambaAll versions (No fix recorded) | < 2:4.15.13+dfsg-0ubuntu0.20.04.2 | < 2:4.15.13+dfsg-0ubuntu1.1
Debian1 product
- samba< 2:4.17.7+dfsg-1
Opensuse1 product
- ldb&distro=openSUSE Tumbleweed< 2.7.2-1.1
Samba1 product
- sambaEOL≥ 4.0.0, < 4.16.10 | ≥ 4.17.0, < 4.17.7 | 4.18.0 | 4.18.0:rc1 | 4.18.0:rc2 | 4.18.0:rc3 | 4.18.0:rc4
4 vendors · 5 products
References
11 links- security.netapp.com/advisory/ntap-20230406-0007/Third Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- security.gentoo.org/glsa/202309-06Vendor Advisory
