CVE catalog

CVE-2021-20208

cifs-utils: CVE-2021-20208

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.67% · Oct 25, 2026

A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancifs-utilssid2:7.9-1fixed
Debiancifs-utilsforky2:7.9-1fixed
Debiancifs-utilstrixie2:7.4-1fixed
Debiancifs-utilstrixie-security2:7.4-1+deb13u2fixed
Debiancifs-utilsbookworm2:7.0-2fixed
Alpinecifs-utils3.106.13-r0fixed
Alpinecifs-utils3.116.13-r0fixed
Alpinecifs-utils3.126.13-r0fixed
Alpinecifs-utils3.136.13-r0fixed
Alpinecifs-utils3.146.13-r0fixed
Alpinecifs-utils3.156.13-r0fixed
Alpinecifs-utils3.166.13-r0fixed
Alpinecifs-utils3.176.13-r0fixed
Alpinecifs-utils3.186.13-r0fixed
Alpinecifs-utils3.196.13-r0fixed
Alpinecifs-utils3.206.13-r0fixed
Alpinecifs-utils3.216.13-r0fixed
Alpinecifs-utils3.226.13-r0fixed
Alpinecifs-utils3.236.13-r0fixed
Alpinecifs-utils3.246.13-r0fixed
Susecifs-utilslinux enterprise module for basesystem 15 sp26.9-5.9.1fixed
Ubuntucifs-utilspro2:6.4-1ubuntu1vulnerable
Ubuntucifs-utilspro2:6.4-1ubuntu1.1vulnerable
Ubuntucifs-utilspro2:6.4-1ubuntu1.1+esm1fixed
Ubuntucifs-utils18.042:6.7-1vulnerable
Ubuntucifs-utils18.042:6.8-1vulnerable
Ubuntucifs-utils18.042:6.8-1ubuntu1vulnerable
Ubuntucifs-utils18.042:6.8-1ubuntu1.1vulnerable
Ubuntucifs-utils18.042:6.8-1ubuntu1.2fixed
Ubuntucifs-utils20.042:6.9-0ubuntu1vulnerable
Ubuntucifs-utils20.042:6.9-1vulnerable
Ubuntucifs-utils20.042:6.9-1ubuntu0.1vulnerable
Ubuntucifs-utils20.042:6.9-1ubuntu0.2fixed
Susecifs-utilslinux enterprise software development kit 12 sp56.9-13.14.1fixed
Susecifs-utilslinux enterprise server 12 sp56.9-13.14.1fixed
Susecifs-utilslinux enterprise server for sap applications 12 sp56.9-13.14.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancifs-utilssourcesid2:6.11-3not yet assignedNot reported[987308]
Debiancifs-utilssourceforky2:6.11-3not yet assignedNot reported[987308]
Debiancifs-utilssourcetrixie2:6.11-3not yet assignedNot reported[987308]
Debiancifs-utilssourcebookworm2:6.11-3not yet assignedNot reported[987308]
Alpinecifs-utilsapk3.106.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Alpinecifs-utilsapk3.116.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Alpinecifs-utilsapk3.126.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Alpinecifs-utilsapk3.136.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Alpinecifs-utilsapk3.146.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Alpinecifs-utilsapk3.156.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Alpinecifs-utilsapk3.166.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Alpinecifs-utilsapk3.176.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Alpinecifs-utilsapk3.186.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Alpinecifs-utilsapk3.196.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Alpinecifs-utilsapk3.206.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Alpinecifs-utilsapk3.216.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Alpinecifs-utilsapk3.226.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Alpinecifs-utilsapk3.236.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Alpinecifs-utilsapk3.246.13-r0Not reportedALPINE-CVE-2021-20208Not reported
Susecifs-utilsrpmlinux enterprise module for basesystem 15 sp26.9-5.9.1Not reportedSUSE-SU-2021:1161-1Not reported
Ubuntucifs-utilsdebpro2:6.4-1ubuntu1.1+esm1Not reportedUBUNTU-CVE-2021-20208Not reported
Ubuntucifs-utilsdeb18.042:6.8-1ubuntu1.2Not reportedUBUNTU-CVE-2021-20208Not reported
Ubuntucifs-utilsdeb20.042:6.9-1ubuntu0.2Not reportedUBUNTU-CVE-2021-20208Not reported
Susecifs-utilsrpmlinux enterprise software development kit 12 sp56.9-13.14.1Not reportedSUSE-SU-2021:1159-1Not reported
Susecifs-utilsrpmlinux enterprise server 12 sp56.9-13.14.1Not reportedSUSE-SU-2021:1159-1Not reported
Susecifs-utilsrpmlinux enterprise server for sap applications 12 sp56.9-13.14.1Not reportedSUSE-SU-2021:1159-1Not reported

[Debian bug #987308]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [cifs-utils]Unknown
    Details (2)

    • 2:7.0-2 · amd64 · bookworm

      Fixed · Fixed: 2:6.11-3

      dsa · cifs-utils · debian · bookworm; dsa · cifs-utils · debian · 12

    • 2:7.0-2 · arm64 · bookworm

      Fixed · Fixed: 2:6.11-3

      dsa · cifs-utils · debian · bookworm; dsa · cifs-utils · debian · 12

[Debian 13 (Trixie)]

  • [cifs-utils]Unknown
    Details (4)

    • 2:7.4-1 · amd64 · trixie

      Fixed · Fixed: 2:6.11-3

      dsa · cifs-utils · debian · 13

    • 2:7.4-1 · arm64 · trixie

      Fixed · Fixed: 2:6.11-3

      dsa · cifs-utils · debian · 13

    • 2:7.4-1+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 2:6.11-3

      dsa · cifs-utils · debian · 13

    • 2:7.4-1+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 2:6.11-3

      dsa · cifs-utils · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]