CVE catalog

CVE-2020-14342

cifs-utils: CVE-2020-14342

[CVE catalog]

Severity
Medium · CVSS 4.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.65% · Oct 25, 2026

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancifs-utilssid2:7.9-1fixed
Debiancifs-utilsforky2:7.9-1fixed
Debiancifs-utilstrixie2:7.4-1fixed
Debiancifs-utilstrixie-security2:7.4-1+deb13u2fixed
Debiancifs-utilsbookworm2:7.0-2fixed
Alpinecifs-utils3.116.13-r0fixed
Alpinecifs-utils3.136.11-r0fixed
Ubuntucifs-utilspro2:6.4-1ubuntu1vulnerable
Ubuntucifs-utilspro2:6.4-1ubuntu1.1vulnerable
Ubuntucifs-utilspro2:6.4-1ubuntu1.1+esm1fixed
Ubuntucifs-utils18.042:6.7-1vulnerable
Ubuntucifs-utils18.042:6.8-1vulnerable
Ubuntucifs-utils18.042:6.8-1ubuntu1vulnerable
Ubuntucifs-utils18.042:6.8-1ubuntu1.1vulnerable
Ubuntucifs-utils18.042:6.8-1ubuntu1.2fixed
Ubuntucifs-utils20.042:6.9-0ubuntu1vulnerable
Ubuntucifs-utils20.042:6.9-1vulnerable
Ubuntucifs-utils20.042:6.9-1ubuntu0.1vulnerable
Ubuntucifs-utils20.042:6.9-1ubuntu0.2fixed
Ubuntucifs-utils22.042:6.11-3.1vulnerable
Ubuntucifs-utils22.042:6.14-1vulnerable
Ubuntucifs-utils22.042:6.14-1build1vulnerable
Ubuntucifs-utils22.042:6.14-1ubuntu0.1fixed
Susecifs-utilslinux enterprise module for basesystem 15 sp16.9-5.6.1fixed
Susecifs-utilslinux enterprise module for basesystem 15 sp26.9-5.6.1fixed
Susecifs-utilslinux enterprise high performance computing 15-espos6.9-3.14.1fixed
Susecifs-utilslinux enterprise high performance computing 15-ltss6.9-3.14.1fixed
Susecifs-utilslinux enterprise server 15-ltss6.9-3.14.1fixed
Susecifs-utilslinux enterprise server for sap applications 156.9-3.14.1fixed
Opensusecifs-utilsleap 15.16.9-lp151.4.7.1fixed
Opensusecifs-utilsleap 15.26.9-lp152.2.3.1fixed
Susecifs-utilslinux enterprise software development kit 12 sp56.9-13.11.1fixed
Susecifs-utilslinux enterprise server 12 sp56.9-13.11.1fixed
Susecifs-utilslinux enterprise server for sap applications 12 sp56.9-13.11.1fixed
Ubuntucifs-utilspro2:6.4-1ubuntu1vulnerable
Ubuntucifs-utilspro2:6.4-1ubuntu1.1vulnerable
Ubuntucifs-utilspro2:6.4-1ubuntu1.1+esm1fixed
Ubuntucifs-utils18.042:6.7-1vulnerable
Ubuntucifs-utils18.042:6.8-1vulnerable
Ubuntucifs-utils18.042:6.8-1ubuntu1vulnerable
Ubuntucifs-utils18.042:6.8-1ubuntu1.1vulnerable
Ubuntucifs-utils18.042:6.8-1ubuntu1.2fixed
Ubuntucifs-utils20.042:6.9-0ubuntu1vulnerable
Ubuntucifs-utils20.042:6.9-1vulnerable
Ubuntucifs-utils20.042:6.9-1ubuntu0.1vulnerable
Ubuntucifs-utils20.042:6.9-1ubuntu0.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancifs-utilssourcesid2:6.11-1not yet assignedNot reported[970172]
Debiancifs-utilssourceforky2:6.11-1not yet assignedNot reported[970172]
Debiancifs-utilssourcetrixie2:6.11-1not yet assignedNot reported[970172]
Debiancifs-utilssourcebookworm2:6.11-1not yet assignedNot reported[970172]
Alpinecifs-utilsapk3.116.13-r0Not reportedALPINE-CVE-2020-14342Not reported
Alpinecifs-utilsapk3.136.11-r0Not reportedALPINE-CVE-2020-14342Not reported
Ubuntucifs-utilsdebpro2:6.4-1ubuntu1.1+esm1Not reportedUSN-7688-1Not reported
Ubuntucifs-utilsdeb18.042:6.8-1ubuntu1.2Not reportedUSN-5459-1Not reported
Ubuntucifs-utilsdeb20.042:6.9-1ubuntu0.2Not reportedUSN-5459-1Not reported
Ubuntucifs-utilsdeb22.042:6.14-1ubuntu0.1Not reportedUSN-5459-1Not reported
Susecifs-utilsrpmlinux enterprise module for basesystem 15 sp16.9-5.6.1Not reportedSUSE-SU-2020:2729-1Not reported
Susecifs-utilsrpmlinux enterprise module for basesystem 15 sp26.9-5.6.1Not reportedSUSE-SU-2020:2729-1Not reported
Susecifs-utilsrpmlinux enterprise high performance computing 15-espos6.9-3.14.1Not reportedSUSE-SU-2021:1455-1Not reported
Susecifs-utilsrpmlinux enterprise high performance computing 15-ltss6.9-3.14.1Not reportedSUSE-SU-2021:1455-1Not reported
Susecifs-utilsrpmlinux enterprise server 15-ltss6.9-3.14.1Not reportedSUSE-SU-2021:1455-1Not reported
Susecifs-utilsrpmlinux enterprise server for sap applications 156.9-3.14.1Not reportedSUSE-SU-2021:1455-1Not reported
Opensusecifs-utilsrpmleap 15.16.9-lp151.4.7.1Not reportedOPENSUSE-SU-2020:1579-1Not reported
Opensusecifs-utilsrpmleap 15.26.9-lp152.2.3.1Not reportedOPENSUSE-SU-2021:0639-1Not reported
Susecifs-utilsrpmlinux enterprise software development kit 12 sp56.9-13.11.1Not reportedSUSE-SU-2020:2728-1Not reported
Susecifs-utilsrpmlinux enterprise server 12 sp56.9-13.11.1Not reportedSUSE-SU-2020:2728-1Not reported
Susecifs-utilsrpmlinux enterprise server for sap applications 12 sp56.9-13.11.1Not reportedSUSE-SU-2020:2728-1Not reported
Ubuntucifs-utilsdebpro2:6.4-1ubuntu1.1+esm1Not reportedUBUNTU-CVE-2020-14342Not reported
Ubuntucifs-utilsdeb18.042:6.8-1ubuntu1.2Not reportedUBUNTU-CVE-2020-14342Not reported
Ubuntucifs-utilsdeb20.042:6.9-1ubuntu0.2Not reportedUBUNTU-CVE-2020-14342Not reported

[Debian bug #970172]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [cifs-utils]Unknown
    Details (2)

    • 2:7.0-2 · amd64 · bookworm

      Fixed · Fixed: 2:6.11-1

      dsa · cifs-utils · debian · bookworm; dsa · cifs-utils · debian · 12

    • 2:7.0-2 · arm64 · bookworm

      Fixed · Fixed: 2:6.11-1

      dsa · cifs-utils · debian · bookworm; dsa · cifs-utils · debian · 12

[Debian 13 (Trixie)]

  • [cifs-utils]Unknown
    Details (4)

    • 2:7.4-1 · amd64 · trixie

      Fixed · Fixed: 2:6.11-1

      dsa · cifs-utils · debian · 13

    • 2:7.4-1 · arm64 · trixie

      Fixed · Fixed: 2:6.11-1

      dsa · cifs-utils · debian · 13

    • 2:7.4-1+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 2:6.11-1

      dsa · cifs-utils · debian · 13

    • 2:7.4-1+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 2:6.11-1

      dsa · cifs-utils · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]