Vulnerability Description
The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Canonical | Ubuntu Linux | 14.04 |
| Debian | Debian Linux | 9.0 |
| Samba | Samba | >= 4.0.0, < 4.6.16 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/105081Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10919Issue TrackingThird Party Advisory
- https://security.gentoo.org/glsa/202003-52
- https://security.netapp.com/advisory/ntap-20180814-0001/Third Party Advisory
- https://usn.ubuntu.com/3738-1/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4271Third Party Advisory
- https://www.samba.org/samba/security/CVE-2018-10919.htmlPatchVendor Advisory
- http://www.securityfocus.com/bid/105081Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10919Issue TrackingThird Party Advisory
- https://security.gentoo.org/glsa/202003-52
- https://security.netapp.com/advisory/ntap-20180814-0001/Third Party Advisory
- https://usn.ubuntu.com/3738-1/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4271Third Party Advisory
- https://www.samba.org/samba/security/CVE-2018-10919.htmlPatchVendor Advisory
FAQ
What is CVE-2018-10919?
CVE-2018-10919 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential ...
How severe is CVE-2018-10919?
CVE-2018-10919 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-10919?
Check the references section above for vendor advisories and patch information. Affected products include: Canonical Ubuntu Linux, Debian Debian Linux, Samba Samba.