CVE-2023-34968

Published: Jul 20, 2023Modified: Dec 6, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path.

Affected (10)

Products: Samba: Samba · Fedoraproject: Fedora · Redhat: Enterprise Linux, Storage · +1 more

Show all products

Samba: Samba · Fedoraproject: Fedora · Redhat: Enterprise Linux, Storage · Debian: Debian Linux

1 product

1 product

2 products

Enterprise Linux

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Samba Samba	Before 4.16.11
Samba Samba	From 4.17.0 to 4.17.10
Samba Samba	From 4.18.0 to 4.18.5

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 37
Fedoraproject Fedora	Version 38

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0
Redhat Storage	Version 3.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 12.0

Related CWEs

Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

References (18)

https://access.redhat.com/errata/RHSA-2023:6667

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2023:7139

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:0423

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2024:0580

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2023-34968

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2222795

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://www.samba.org/samba/security/CVE-2023-34968.html

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2023:6667

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2023:7139

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:0423

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2024:0580

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/security/cve/CVE-2023-34968

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2222795

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPCSGND7LO467AJGR5DYBGZLTCGTOBCC/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OT74M42E6C36W7PQVY3OS4ZM7DVYB64Z/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20230731-0010/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.debian.org/security/2023/dsa-5477

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.samba.org/samba/security/CVE-2023-34968.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.