CVE-2020-27840

2021-03-2400:00:00

ubuntu.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.009 Low

EPSS

Percentile

82.7%

JSON

A flaw was found in samba. Spaces used in a string around a domain name
(DN), while supposed to be ignored, can cause invalid DN strings with
spaces to instead write a zero-byte into out-of-bounds memory, resulting in
a crash. The highest threat from this vulnerability is to system
availability.

Bugs

<https://bugzilla.samba.org/show_bug.cgi?id=14595>

Notes

Author	Note
mdeslaur	This issue is actually in the ldb package, the samba package uses the system ldb library, not the included one

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchldb< 2:1.2.3-1ubuntu0.2UNKNOWN
ubuntu20.04noarchldb< 2:2.0.10-0ubuntu0.20.04.3UNKNOWN
ubuntu20.10noarchldb< 2:2.1.4-2ubuntu0.1UNKNOWN
ubuntu14.04noarchldb< 1:1.1.24-0ubuntu0.14.04.2+esm1UNKNOWN
ubuntu16.04noarchldb< 2:1.1.24-1ubuntu3.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	ldb	< 2:1.2.3-1ubuntu0.2	UNKNOWN
ubuntu	20.04	noarch	ldb	< 2:2.0.10-0ubuntu0.20.04.3	UNKNOWN
ubuntu	20.10	noarch	ldb	< 2:2.1.4-2ubuntu0.1	UNKNOWN
ubuntu	14.04	noarch	ldb	< 1:1.1.24-0ubuntu0.14.04.2+esm1	UNKNOWN
ubuntu	16.04	noarch	ldb	< 2:1.1.24-1ubuntu3.2	UNKNOWN