CVE-2022-1615 — Use of Insufficiently Random Values in Samba

CWE-330 — Use of Insufficiently Random ValuesCWE-252 — Unchecked Return Value7 documents7 sources
Severity
5.5MEDIUMNVD
EPSS
0.3%
top 47.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
SambaDebian SambaFedoraproject Fedora+1 more
Timeline
PublishedSep 1
Latest updateJan 26

Description

In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶NVDsamba/samba4.1.0 — 4.17.0
▶debiandebian/samba< samba 2:4.16.5+dfsg-2 (bookworm)
▶Debiansamba/samba< 2:4.16.5+dfsg-2+2
▶CVEListV5samba/sambaSamba 4.1 and newer

Also affects: Fedora 37

Patches

Patch: gitlab.com ↗Patch: gitlab.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-hhph-6qvj-8859: In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values↗2022-09-02
▶
OSV
CVE-2022-1615: In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values↗2022-09-01
▶

📋Vendor Advisories

3
Microsoft
In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.↗2022-09-13
▶
Red Hat
samba: GnuTLS gnutls_rnd() can fail and give predictable random values↗2022-07-27
▶
Debian
CVE-2022-1615: samba - In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.↗2022
▶

🕵️Threat Intelligence

1
Talos
Vulnerability Spotlight: OS command injection, directory traversal and other vulnerabilities found in Siretta Quartz-Gold and FreshTomato↗2023-01-26
▶