critical
CVE-2019-10197
samba: Combination of parameters and permissions can allow user to escape from the share path definition
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium), Amazon (medium), Oracle (medium), Ubuntu (medium).
Description
A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.10 | samba | 4.10.8-r0 |
| alpine 3.11 | samba | 4.10.8-r0 |
| alpine 3.12 | samba | 4.10.8-r0 |
| alpine 3.13 | samba | 4.10.8-r0 |
| alpine 3.14 | samba | 4.10.8-r0 |
| alpine 3.15 | samba | 4.10.8-r0 |
| alpine 3.16 | samba | 4.10.8-r0 |
| alpine 3.17 | samba | 4.10.8-r0 |
| alpine 3.18 | samba | 4.10.8-r0 |
| alpine 3.19 | samba | 4.10.8-r0 |
| alpine 3.20 | samba | 4.10.8-r0 |
| alpine 3.21 | samba | 4.10.8-r0 |
Show all 130 entries from 30 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.10 | samba | 4.10.8-r0 |
| alpine 3.11 | samba | 4.10.8-r0 |
| alpine 3.12 | samba | 4.10.8-r0 |
| alpine 3.13 | samba | 4.10.8-r0 |
| alpine 3.14 | samba | 4.10.8-r0 |
| alpine 3.15 | samba | 4.10.8-r0 |
| alpine 3.16 | samba | 4.10.8-r0 |
| alpine 3.17 | samba | 4.10.8-r0 |
| alpine 3.18 | samba | 4.10.8-r0 |
| alpine 3.19 | samba | 4.10.8-r0 |
| alpine 3.20 | samba | 4.10.8-r0 |
| alpine 3.21 | samba | 4.10.8-r0 |
| alpine 3.22 | samba | 4.10.8-r0 |
| alpine 3.23 | samba | 4.10.8-r0 |
| alpine 3.24 | samba | 4.10.8-r0 |
| alpine edge | samba | 4.10.8-r0 |
| amazon linux 1 | ctdb | 4.10.4-11.51.amzn1 |
| amazon linux 1 | ctdb-tests | 4.10.4-11.51.amzn1 |
| amazon linux 1 | libsmbclient | 4.10.4-11.51.amzn1 |
| amazon linux 1 | libsmbclient-devel | 4.10.4-11.51.amzn1 |
| amazon linux 1 | libwbclient | 4.10.4-11.51.amzn1 |
| amazon linux 1 | libwbclient-devel | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-client | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-client-libs | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-common | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-common-libs | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-common-tools | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-debuginfo | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-devel | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-krb5-printing | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-libs | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-pidl | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-python | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-python-test | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-test | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-test-libs | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-winbind | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-winbind-clients | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-winbind-krb5-locator | 4.10.4-11.51.amzn1 |
| amazon linux 1 | samba-winbind-modules | 4.10.4-11.51.amzn1 |
| amazon linux 2 | ctdb | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | ctdb-tests | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | libsmbclient | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | libsmbclient-devel | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | libwbclient | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | libwbclient-devel | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-client | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-client-libs | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-common | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-common-libs | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-common-tools | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-dc | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-dc-libs | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-debuginfo | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-devel | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-krb5-printing | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-libs | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-pidl | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-python | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-python-test | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-test | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-test-libs | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-vfs-glusterfs | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-winbind | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-winbind-clients | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-winbind-krb5-locator | 4.10.4-11.amzn2.0.1 |
| amazon linux 2 | samba-winbind-modules | 4.10.4-11.amzn2.0.1 |
| debian 10 | samba | 2:4.9.5+dfsg-5+deb10u1 |
| debian 11 | samba | 2:4.9.13+dfsg-1 |
| debian 12 | samba | 2:4.9.13+dfsg-1 |
| debian 13 | samba | 2:4.9.13+dfsg-1 |
| debian 14 | samba | 2:4.9.13+dfsg-1 |
| echo | samba | 2:4.9.13+dfsg-1 |
| Oracle Linux 7 | ctdb | 4.10.4-10.el7 |
| Oracle Linux 7 | ctdb-tests | 4.10.4-10.el7 |
| Oracle Linux 7 | libsmbclient | 4.10.4-10.el7 |
| Oracle Linux 7 | libsmbclient-devel | 4.10.4-10.el7 |
| Oracle Linux 7 | libwbclient | 4.10.4-10.el7 |
| Oracle Linux 7 | libwbclient-devel | 4.10.4-10.el7 |
| Oracle Linux 7 | samba | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-client | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-client-libs | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-common | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-common-libs | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-common-tools | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-dc | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-dc-libs | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-devel | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-krb5-printing | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-libs | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-pidl | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-python | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-python-test | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-test | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-test-libs | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-vfs-glusterfs | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-winbind | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-winbind-clients | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-winbind-krb5-locator | 4.10.4-10.el7 |
| Oracle Linux 7 | samba-winbind-modules | 4.10.4-10.el7 |
| Oracle Linux 8 | ctdb | 4.11.2-13.el8 |
| Oracle Linux 8 | ctdb-tests | 4.11.2-13.el8 |
| Oracle Linux 8 | libsmbclient | 4.11.2-13.el8 |
| Oracle Linux 8 | libsmbclient-devel | 4.11.2-13.el8 |
| Oracle Linux 8 | libwbclient | 4.11.2-13.el8 |
| Oracle Linux 8 | libwbclient-devel | 4.11.2-13.el8 |
| Oracle Linux 8 | openchange | 2.3-24.0.1.el8 |
| Oracle Linux 8 | python3-samba | 4.11.2-13.el8 |
| Oracle Linux 8 | python3-samba-test | 4.11.2-13.el8 |
| Oracle Linux 8 | samba | 4.11.2-13.el8 |
| Oracle Linux 8 | samba-client | 4.11.2-13.el8 |
| Oracle Linux 8 | samba-client-libs | 4.11.2-13.el8 |
| Oracle Linux 8 | samba-common | 4.11.2-13.el8 |
| Oracle Linux 8 | samba-common-libs | 4.11.2-13.el8 |
| Oracle Linux 8 | samba-common-tools | 4.11.2-13.el8 |
| Oracle Linux 8 | samba-krb5-printing | 4.11.2-13.el8 |
| Oracle Linux 8 | samba-libs | 4.11.2-13.el8 |
| Oracle Linux 8 | samba-pidl | 4.11.2-13.el8 |
| Oracle Linux 8 | samba-test | 4.11.2-13.el8 |
| Oracle Linux 8 | samba-test-libs | 4.11.2-13.el8 |
| Oracle Linux 8 | samba-winbind | 4.11.2-13.el8 |
| Oracle Linux 8 | samba-winbind-clients | 4.11.2-13.el8 |
| Oracle Linux 8 | samba-winbind-krb5-locator | 4.11.2-13.el8 |
| Oracle Linux 8 | samba-winbind-modules | 4.11.2-13.el8 |
| root.io alpine 3.18 | rootio-samba | 4.10.8-r0 |
| root.io alpine 3.19 | rootio-samba | 4.10.8-r0 |
| root.io debian 12 | rootio-samba | 2:4.9.13+dfsg-1 |
| ubuntu 19.04 | samba | 2:4.10.0+dfsg-0ubuntu2.4 |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00045.html
- https://access.redhat.com/errata/RHSA-2019:3253
- https://access.redhat.com/errata/RHSA-2019:4023
- https://access.redhat.com/security/cve/CVE-2019-10197
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10197
- https://linux.oracle.com/cve/CVE-2019-10197.html
- https://linux.oracle.com/errata/ELSA-2020-1878.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56ZUXHGDHPM7S6RVAKULZT5EATS37OKA/
All 21 references
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M7NYIUZOCIDXWXGWMZ7O5Z7OJ6IX7EAB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z6EEKFT24DQI4DMZMSQTLMNZWG4RMZ57/
- https://nvd.nist.gov/vuln/detail/CVE-2019-10197
- https://seclists.org/bugtraq/2019/Sep/4
- https://security.gentoo.org/glsa/202003-52
- https://security.netapp.com/advisory/ntap-20190903-0001/
- https://support.f5.com/csp/article/K69511801
- https://support.f5.com/csp/article/K69511801?utm_source=f5support&%3Butm_medium=RSS
- https://ubuntu.com/security/notices/USN-4121-1
- https://usn.ubuntu.com/4121-1/
- https://www.cve.org/CVERecord?id=CVE-2019-10197
- https://www.debian.org/security/2019/dsa-4513
- https://www.samba.org/samba/security/CVE-2019-10197.html