{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"samba","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.6-2.el8_9","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"samba","product":"Red Hat Enterprise Linux 8.6 Extended Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.15.5-13.el8_6","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"samba","product":"Red Hat Enterprise Linux 8.8 Extended Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.17.5-4.el8_8","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"samba","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.6-101.el9_3","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"samba","product":"Red Hat Enterprise Linux 9.0 Extended Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.15.5-111.el9_0","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"samba","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.17.5-104.el9_2","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"samba","product":"Red Hat Virtualization 4 for Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.15.5-13.el8_6","versionType":"rpm"}]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"samba","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"samba4","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"samba","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"samba","product":"Red Hat Storage 3","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2023-4091","cwes":["CWE-276"],"description":"A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module \"acl_xattr\" is configured with \"acl_xattr:ignore system acls = yes\". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.","epss":{"date":"2026-11-07","percentile":0.71323,"score":0.01334},"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}],"modifiedAt":1794058894640,"publishedAt":1698998195611,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2023:6209"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2023:6744"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2023:7371"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2023:7408"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2023:7464"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2023:7467"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2023-4091"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241882"},{"source":"CNA: redhat","tags":[],"url":"https://bugzilla.samba.org/show_bug.cgi?id=15439"},{"source":"CNA: redhat","tags":[],"url":"https://www.samba.org/samba/security/CVE-2023-4091.html"},{"source":"ADP: CVE","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2023:6209"},{"source":"ADP: CVE","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2023:6744"},{"source":"ADP: CVE","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2023:7371"},{"source":"ADP: CVE","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2023:7408"},{"source":"ADP: CVE","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2023:7464"},{"source":"ADP: CVE","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2023:7467"},{"source":"ADP: CVE","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/security/cve/CVE-2023-4091"},{"source":"ADP: CVE","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241882"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://bugzilla.samba.org/show_bug.cgi?id=15439"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZUMVALLFFDFC53JZMUWA6HPD7HUGAP5I/"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://security.netapp.com/advisory/ntap-20231124-0002/"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://www.samba.org/samba/security/CVE-2023-4091.html"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"The vulnerability is most commonly associated with the \"acl_xattr\" module and can be mitigated by setting:\n~~~\n\"acl_xattr:ignore system acls = no\"\n~~~"}],"revision":"6e8d7819ae6fb01e443a2cbe2e45108bce1bff7542704ee4a6b18274c133ce64","sources":[{"modifiedAt":1794058894640,"name":"CNA: redhat","retrievedAt":1794060509329,"url":"https://www.cve.org/CVERecord?id=CVE-2023-4091"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794064132993,"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-4091"}],"ssvc":{"assessedAt":1714061892014,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Samba: smb clients can truncate files with read-only permissions","updatedAt":1794064132993}