Updated cifs-utils packages fix a security vulnerability

2021-06-2320:11:28

Gentoo Foundation

advisories.mageia.org

6.1 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N

4.9 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

37.6%

JSON

A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity (CVE-2021-20208).

OSVersionArchitecturePackageVersionFilename
Mageia7noarchcifs-utils< 6.9-6.2cifs-utils-6.9-6.2.mga7
Mageia8noarchcifs-utils< 6.11-2.1cifs-utils-6.11-2.1.mga8