CVE-2020-14342

See a problem?

Source

https://nvd.nist.gov/vuln/detail/CVE-2020-14342

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-14342.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-14342

Related

Published

2020-09-09T12:15:11Z

Modified

2024-09-11T04:34:57.889747Z

Severity

7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.

References

Affected packages

Alpine:v3.10 / cifs-utils

Package

Name: cifs-utils
Purl: pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Alpine:v3.11 / cifs-utils

Package

Name: cifs-utils
Purl: pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.13-r0

Affected versions

4.*

4.9-r0

5.*

5.3-r0

5.4-r0

5.6-r0

5.7-r0

5.8-r0

5.9-r0

6.*

6.0-r0

6.1-r0

6.2-r0

6.2-r1

6.3-r0

6.4-r0

6.4-r1

6.4-r2

6.5-r0

6.6-r0

6.7-r0

6.7-r1

6.8-r0

6.9-r0

6.9-r1

Alpine:v3.12 / cifs-utils

Package

Name: cifs-utils
Purl: pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Alpine:v3.13 / cifs-utils

Package

Name: cifs-utils
Purl: pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.11-r0

Affected versions

4.*

4.9-r0

5.*

5.3-r0

5.4-r0

5.6-r0

5.7-r0

5.8-r0

5.9-r0

6.*

6.0-r0

6.1-r0

6.2-r0

6.2-r1

6.3-r0

6.4-r0

6.4-r1

6.4-r2

6.5-r0

6.6-r0

6.7-r0

6.7-r1

6.8-r0

6.9-r0

6.9-r1

6.10-r0

6.10-r1

Alpine:v3.14 / cifs-utils

Package

Name: cifs-utils
Purl: pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Alpine:v3.15 / cifs-utils

Package

Name: cifs-utils
Purl: pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Alpine:v3.16 / cifs-utils

Package

Name: cifs-utils
Purl: pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Alpine:v3.17 / cifs-utils

Package

Name: cifs-utils
Purl: pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Alpine:v3.18 / cifs-utils

Package

Name: cifs-utils
Purl: pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Alpine:v3.19 / cifs-utils

Package

Name: cifs-utils
Purl: pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Alpine:v3.20 / cifs-utils

Package

Name: cifs-utils
Purl: pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Debian:11 / cifs-utils

Package

Name: cifs-utils
Purl: pkg:deb/debian/cifs-utils?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2:6.11-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / cifs-utils

Package

Name: cifs-utils
Purl: pkg:deb/debian/cifs-utils?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2:6.11-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / cifs-utils

Package

Name: cifs-utils
Purl: pkg:deb/debian/cifs-utils?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2:6.11-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/piastry/cifs-utils

Affected ranges

Type: GIT
Repo: https://github.com/piastry/cifs-utils
Events: Introduced

9449c2ac7419ef45fc08f7d4a654c100ee26fa17

Last affected

5ff5fc2ecc10353fd39ad508db5c2828fd2d8d9a

Affected versions

cifs-utils-5.*

cifs-utils-5.6

cifs-utils-5.7

cifs-utils-5.8

cifs-utils-5.9

cifs-utils-6.*

cifs-utils-6.0

cifs-utils-6.1

cifs-utils-6.10

cifs-utils-6.2

cifs-utils-6.3

cifs-utils-6.4

cifs-utils-6.5

cifs-utils-6.6

cifs-utils-6.7

cifs-utils-6.8

cifs-utils-6.9