CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:NCVE-2015-5296
Medium (5.4). EPSS 7.3% chance of exploitation in the next 30 days.
Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.
Severity
- EPSS
- 7.3% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- samba:samba
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.html
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html