CVE-2021-20251

A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1929800	Issue Tracking Third Party Advisory
https://bugzilla.samba.org/show_bug.cgi?id=14611	Exploit Issue Tracking Third Party Advisory
https://security.gentoo.org/glsa/202309-06
https://security.netapp.com/advisory/ntap-20230331-0005/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:samba:samba::::::::
	cpe:2.3:a:samba:samba::::::::

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-03-06 23:15

Updated : 2023-09-17 09:15

NVD link : CVE-2021-20251

Mitre link : CVE-2021-20251

CVE.ORG link : CVE-2021-20251

JSON object : View

Products Affected

samba

samba

fedoraproject

fedora

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2021-20251", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2023-03-06T23:15:10.387", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1929800", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.samba.org/show_bug.cgi?id=14611", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://security.gentoo.org/glsa/202309-06", "source": "secalert@redhat.com"}, {"url": "https://security.netapp.com/advisory/ntap-20230331-0005/", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met."}, {"lang": "es", "value": "Se ha encontrado un fallo en samba. Una condici\u00f3n de ejecuci\u00f3n en el c\u00f3digo de bloqueo de contrase\u00f1as puede conllevar el riesgo de que los ataques de fuerza bruta tengan \u00e9xito si se cumplen unas condiciones especiales."}], "lastModified": "2023-09-17T09:15:09.353", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "117BD99B-5201-47C9-8A0C-99C23BAACE76", "versionEndExcluding": "4.16.8", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96E911B3-B4DD-451C-9579-74559328F89F", "versionEndExcluding": "4.17.4", "versionStartIncluding": "4.17.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}