CVE-2020-25719

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-18 · updated 2026-06-17
Weakness: CWE-287

Description

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.

Affected products

Canonical Ubuntu Linux: 20.04, 21.04, 21.10
Debian Linux: 9.0, 10.0
Fedoraproject Fedora: 33, 34, 35
Red Hat Enterprise Linux: 7.0, 8.0
RedHat Enterprise Linux Desktop: 7.0
RedHat Enterprise Linux Eus: 8.2, 8.4
RedHat Enterprise Linux For Ibm Z Systems: 7.0, 8.0
RedHat Enterprise Linux For Ibm Z Systems Eus: 8.2, 8.4
RedHat Enterprise Linux For Power Big Endian: 7.0
RedHat Enterprise Linux For Power Little Endian: 7.0, 8.0
RedHat Enterprise Linux For Power Little Endian Eus: 8.2, 8.4
RedHat Enterprise Linux For Scientific Computing: 7.0
RedHat Enterprise Linux Server Aus: 8.2, 8.4
RedHat Enterprise Linux Server Tus: 8.2, 8.4
RedHat Enterprise Linux Server Update Services For Sap Solutions: 8.2, 8.4
RedHat Enterprise Linux Workstation: 7.0
Samba: from 4.0.0 before 4.13.14; from 4.14.0 before 4.14.10; from 4.15.0 before 4.15.2 — fixed in 4.13.14, 4.14.10, 4.15.2

How to fix

Upgrade to a fixed version: Samba 4.13.14, 4.14.10, 4.15.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-25719 or the next vulnerability affects your stack