Alpine Linux: CVE-2022-3592: Link Following

Alpine Linux: CVE-2022-3592: Link Following

Severity

7

CVSS

(AV:N/AC:L/Au:S/C:C/I:N/A:N)

Published

01/12/2023

Created

08/23/2024

Added

08/22/2024

Modified

10/02/2024

Description

A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem.

Solution(s)

• alpine-linux-upgrade-samba

References

• https://attackerkb.com/topics/cve-2022-3592
• CVE - 2022-3592
• https://security.alpinelinux.org/vuln/CVE-2022-3592