Vulnerability Description
A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Samba | Samba | >= 4.5.0, < 4.10.17 |
| Redhat | Storage | 3.0 |
| Opensuse | Leap | 15.1 |
| Fedoraproject | Fedora | 31 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00000.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.htmlMailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1849489%3B
- https://lists.debian.org/debian-lts-announce/2020/11/msg00041.htmlIssue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202007-15Third Party Advisory
- https://www.debian.org/security/2021/dsa-4884Third Party Advisory
- https://www.samba.org/samba/security/CVE-2020-10730.htmlVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00000.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.htmlMailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1849489%3B
FAQ
What is CVE-2020-10730?
CVE-2020-10730 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with...
How severe is CVE-2020-10730?
CVE-2020-10730 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-10730?
Check the references section above for vendor advisories and patch information. Affected products include: Samba Samba, Redhat Storage, Opensuse Leap, Fedoraproject Fedora, Debian Debian Linux.