CVE-2019-14833

    Dashboard / Vulnerabilities / CVE-2019-14833

    CVE-2019-14833

    Published: 6 Nov 2019Last Modified: 8 Jul 2026

    Summary:

    Details: A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks.

    References: https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html, https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKPYHDFI7HRELVXBE5J4MTGSI35AKFBI/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMIYCYXCPRTVCVZ3TP6ZGPJ6RZS3IX4G/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3IUACPZJXSC4OM6P2V4IC4QMZQZWPD/, http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html, https://www.samba.org/samba/security/CVE-2019-14833.html, https://www.synology.com/security/advisory/Synology_SA_19_35, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14833

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 916fab083a8cb5c10365da7f3a85d0bbfde4a30e
    Fixed -0d69a39c463ea7da23f3b2d1aecedb2d6bbcfd15

    Affected versions

    samba-4.10.9
    samba-4.10.7
    samba-4.10.6
    samba-4.10.1
    samba-4.10.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2019-14833 | CVE-DB