CVE-2021-23192

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	samba	Affects samba v4.10.0 to 4.15.1, Fixed in samba v4.15.2, v4.14.10 and v4.13.14.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2019666Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202309-06
https://ubuntu.com/security/CVE-2021-23192Third Party Advisory
https://www.samba.org/samba/security/CVE-2021-23192.htmlPatch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2019666Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202309-06
https://ubuntu.com/security/CVE-2021-23192Third Party Advisory
https://www.samba.org/samba/security/CVE-2021-23192.htmlPatch, Vendor Advisory

Timeline

Published: Mar 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-231936.5Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators CVE-2021-231955.3Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 has the option for automated indexing (directory listing) activ CVE-2021-231969.8The web application on Agilia Link+ version 3.0 implements authentication and session management mechanisms exclusively on the client-side a CVE-2021-231977.8Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account CVE-2021-231989.8mySCADA myPRO: Versions 8.20.0 and prior has a feature where the password can be specified, which may allow an attacker to inject arbitrary CVE-2021-23209.1Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Management Console). The supp CVE-2021-232017.5NVIDIA GPU and Tegra hardware contain a vulnerability in an internal microcontroller, which may allow a user with elevated privileges to gen CVE-2021-232037.5Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attack CVE-2021-232046.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP key material to be e CVE-2021-232058.1Improper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configuration of Controllers CVE-2021-232067.8A flaw was found in htmldoc in v1.9.12 and prior. A stack buffer overflow in parse_table() in ps-pdf.cxx may lead to execute arbitrary code CVE-2021-232075.5An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vi