CVE-2019-10197

A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "19.04"
                },
                {
                    "last_affected": "19.04"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "canonical:ubuntu_linux",
            "cpes": [
                "cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "10.0"
                },
                {
                    "last_affected": "10.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux",
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"
            ]
        }
    ]
}

References

Affected packages

Git / github.com/samba-team/samba

Affected ranges

Type

GIT

Repo

https://github.com/samba-team/samba

Events

Introduced

4fc4ae2924aaa2fc184b7385069274526fa8a4c2

Last affected

1acf30ac5c1c1ffc6f92ff9786b1be897c3b5092

Introduced

25f2fe02a615e2cf906b6fa495acd8ea0aa9998a

Last affected

2d587a11d5f48a012d06df3c614283013ccf728c

Introduced

7bc8b7f30d35929eb6e84686fdf4abe79e9ac19d

Last affected

c1d9e02d06a158f637475ffeca7a6c3f2fb1d773

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.9.0"
        },
        {
            "last_affected": "4.9.13"
        },
        {
            "introduced": "4.10.0"
        },
        {
            "last_affected": "4.10.8"
        },
        {
            "introduced": "4.9.0-rc1"
        },
        {
            "last_affected": "4.9.0-rc1"
        },
        {
            "introduced": "4.9.0-rc2"
        },
        {
            "last_affected": "4.9.0-rc2"
        },
        {
            "introduced": "4.9.0-rc3"
        },
        {
            "last_affected": "4.9.0-rc3"
        },
        {
            "introduced": "4.9.0-rc4"
        },
        {
            "last_affected": "4.9.0-rc4"
        },
        {
            "introduced": "4.9.0-rc5"
        },
        {
            "last_affected": "4.9.0-rc5"
        },
        {
            "introduced": "4.10.0-rc1"
        },
        {
            "last_affected": "4.10.0-rc1"
        },
        {
            "introduced": "4.10.0-rc2"
        },
        {
            "last_affected": "4.10.0-rc2"
        },
        {
            "introduced": "4.10.0-rc3"
        },
        {
            "last_affected": "4.10.0-rc3"
        },
        {
            "introduced": "4.10.0-rc4"
        },
        {
            "last_affected": "4.10.0-rc4"
        },
        {
            "introduced": "4.11.0"
        },
        {
            "last_affected": "4.11.0"
        },
        {
            "introduced": "4.11.0-rc1"
        },
        {
            "last_affected": "4.11.0-rc1"
        },
        {
            "introduced": "4.11.0-rc2"
        },
        {
            "last_affected": "4.11.0-rc2"
        },
        {
            "introduced": "4.11.0-rc3"
        },
        {
            "last_affected": "4.11.0-rc3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:samba:samba:4.9.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:samba:samba:4.9.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:samba:samba:4.9.0:rc3:*:*:*:*:*:*",
        "cpe:2.3:a:samba:samba:4.9.0:rc4:*:*:*:*:*:*",
        "cpe:2.3:a:samba:samba:4.9.0:rc5:*:*:*:*:*:*",
        "cpe:2.3:a:samba:samba:4.10.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:samba:samba:4.10.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:samba:samba:4.10.0:rc3:*:*:*:*:*:*",
        "cpe:2.3:a:samba:samba:4.10.0:rc4:*:*:*:*:*:*",
        "cpe:2.3:a:samba:samba:4.11.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:samba:samba:4.11.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:samba:samba:4.11.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:samba:samba:4.11.0:rc3:*:*:*:*:*:*"
    ]
}

Affected versions

4.*

4.10.0-rc1

4.10.0-rc2

4.10.0-rc3

4.10.0-rc4

4.11.0

4.11.0-rc1

4.11.0-rc2

4.11.0-rc3

4.9.0-rc1

4.9.0-rc2

4.9.0-rc3

4.9.0-rc4

4.9.0-rc5

ldb-1.*

ldb-1.4.3

ldb-1.4.4

ldb-1.4.5

ldb-1.4.6

ldb-1.4.7

ldb-1.5.0

ldb-1.5.1

ldb-1.5.2

ldb-1.5.5

ldb-1.6.1

ldb-1.6.2

ldb-1.6.3

ldb-2.*

ldb-2.0.5

ldb-2.0.6

samba-4.*

samba-4.10.0

samba-4.10.0rc1

samba-4.10.1

samba-4.10.6

samba-4.10.7

samba-4.10.8

samba-4.11.0rc1

samba-4.11.0rc2

samba-4.11.0rc3

samba-4.9.0

samba-4.9.0rc1

samba-4.9.1

samba-4.9.10

samba-4.9.11

samba-4.9.12

samba-4.9.13

samba-4.9.2

samba-4.9.4

samba-4.9.5

samba-4.9.7

talloc-2.*

talloc-2.1.15

talloc-2.1.16

talloc-2.2.0

tdb-1.*

tdb-1.3.17

tdb-1.3.18

tdb-1.4.0

tdb-1.4.1

tevent-0.*

tevent-0.10.0

tevent-0.9.38

tevent-0.9.39

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10197.json"