Advisory ROSA-SA-2021-1812

2021-07-0216:34:52

ROSA LAB

abf.rosalinux.ru

6.1 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N

7.5 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.037 Low

EPSS

Percentile

91.6%

JSON

Software: cifs-utils 6.2
OS: Cobalt 7.9

CVE-ID: CVE-2014-2830
CVE-Crit: MEDIUM
CVE-DESC: stack-based buffer overflow in cifskey.c or cifscreds.c in cifs-utils before 6.4, used in pam_cifscreds, allows remote attackers to have undefined impact via unknown vectors.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2021-20208
CVE-Crit: MEDIUM
CVE-DESC: a bug was found in cifs-utils in versions prior to 6.13. A user can use host Kerberos credentials when mounting a krb5 CIFS file system from a container. The biggest threat from this vulnerability is to data confidentiality and integrity.
CVE-STATUS: default
CVE-REV: default