OpenCVE

In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Fedoraproject	Fedora
Redhat	Enterprise Linux Rhel Eus Rhev Hypervisor
Samba	Samba

Configuration 1 [-]

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
samba-0:4.17.5-2.el8	cpe:/a:redhat:enterprise_linux:8	RHSA-2023:2987	2023-05-16T00:00:00Z
samba-0:4.17.5-2.el8	cpe:/o:redhat:enterprise_linux:8	RHSA-2023:2987	2023-05-16T00:00:00Z
Red Hat Enterprise Linux 8.6 Extended Update Support
samba-0:4.15.5-15.el8_6	cpe:/a:redhat:rhel_eus:8.6	RHSA-2024:0423	2024-01-25T00:00:00Z
Red Hat Enterprise Linux 9
samba-0:4.17.5-102.el9	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:2519	2023-05-09T00:00:00Z
samba-0:4.17.5-102.el9	cpe:/o:redhat:enterprise_linux:9	RHSA-2023:2519	2023-05-09T00:00:00Z
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8
samba-0:4.15.5-15.el8_6	cpe:/o:redhat:rhev_hypervisor:4.4::el8	RHSA-2024:0423	2024-01-25T00:00:00Z

References

Link	Providers
https://bugzilla.samba.org/show_bug.cgi?id=15103
https://gitlab.com/samba-team/samba/-/merge_requests/2644
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTTOLTHUHOV4SHCHCB5TAA4FQVJAWN4P/
https://nvd.nist.gov/vuln/detail/CVE-2022-1615
https://security.gentoo.org/glsa/202309-06
https://www.cve.org/CVERecord?id=CVE-2022-1615

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2022-09-01T00:00:00

Updated: 2024-08-03T00:10:03.686Z

Reserved: 2022-05-06T00:00:00

Link: CVE-2022-1615

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-09-01T21:15:08.903

Modified: 2024-11-21T06:41:05.690

Link: CVE-2022-1615

Redhat

Severity : Low

Publid Date: 2022-07-27T00:00:00Z

Links: CVE-2022-1615 - Bugzilla

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED3DD507-0A0D-4BB9-8789-FB6BBCDEB506", "versionStartIncluding": "4.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values."}, {"lang": "es", "value": "En Samba, la funci\u00f3n GnuTLS gnutls_rnd() puede fallar y dar valores aleatorios predecibles"}], "id": "CVE-2022-1615", "lastModified": "2024-11-21T06:41:05.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-09-01T21:15:08.903", "references": [{"source": "secalert@redhat.com", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.samba.org/show_bug.cgi?id=15103"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://gitlab.com/samba-team/samba/-/merge_requests/2644"}, {"source": "secalert@redhat.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTTOLTHUHOV4SHCHCB5TAA4FQVJAWN4P/"}, {"source": "secalert@redhat.com", "url": "https://security.gentoo.org/glsa/202309-06"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.samba.org/show_bug.cgi?id=15103"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://gitlab.com/samba-team/samba/-/merge_requests/2644"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTTOLTHUHOV4SHCHCB5TAA4FQVJAWN4P/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/202309-06"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-330"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-330"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:2987", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "samba-0:4.17.5-2.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-05-16T00:00:00Z"}, {"advisory": "RHSA-2023:2987", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "samba-0:4.17.5-2.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-05-16T00:00:00Z"}, {"advisory": "RHSA-2024:0423", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "samba-0:4.15.5-15.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2024-01-25T00:00:00Z"}, {"advisory": "RHSA-2023:2519", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "samba-0:4.17.5-102.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-05-09T00:00:00Z"}, {"advisory": "RHSA-2023:2519", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "samba-0:4.17.5-102.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-05-09T00:00:00Z"}, {"advisory": "RHSA-2024:0423", "cpe": "cpe:/o:redhat:rhev_hypervisor:4.4::el8", "package": "samba-0:4.15.5-15.el8_6", "product_name": "Red Hat Virtualization 4 for Red Hat Enterprise Linux 8", "release_date": "2024-01-25T00:00:00Z"}], "bugzilla": {"description": "samba: GnuTLS gnutls_rnd() can fail and give predictable random values", "id": "2122649", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2122649"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-252->CWE-330", "details": ["In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.", "A flaw was found in Samba. When the gnutls_rnd function is called, its return value is not verified, allowing it to give predictable random values when the call to the gnutls_rnd function fails."], "name": "CVE-2022-1615", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "samba", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "samba4", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "samba", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:storage:3", "fix_state": "Affected", "package_name": "samba", "product_name": "Red Hat Storage 3"}], "public_date": "2022-07-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-1615\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-1615"], "threat_severity": "Low", "upstream_fix": "samba 4.17"}