CVE-2022-29869 Information disclosure in n/a

Medium 5.3 Published 28 Apr 2022 Updated 3 Aug 2024

Verbose logging in cifs-utils may leak sensitive information from files containing equal signs that are not valid credential files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-29869?

CVE-2022-29869 is a medium-severity vulnerability in Debian Debian Linux, published on 28 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file.

Weakness: CWE-532

Which versions are affected by CVE-2022-29869?

It affects 3 products.

Linux distribution packages (10)

`cifs-utils` SUSE:Linux Enterprise Micro 5.2	All versions	`6.9-150100.5.18.1`
`cifs-utils` SUSE:Linux Enterprise Micro 5.3	All versions	`6.15-150400.3.9.1`
`cifs-utils` SUSE:Linux Enterprise Module for Basesystem 15 SP3	All versions	`6.9-150100.5.18.1`
`cifs-utils` SUSE:Linux Enterprise Module for Basesystem 15 SP4	All versions	`6.15-150400.3.9.1`
`cifs-utils` SUSE:Linux Enterprise Server 12 SP5	All versions	`6.9-13.23.1`
`cifs-utils` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`6.9-13.23.1`
`cifs-utils` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`6.9-13.23.1`
`cifs-utils` openSUSE:Leap 15.3	All versions	`6.9-150100.5.18.1`
`cifs-utils` openSUSE:Leap 15.4	All versions	`6.15-150400.3.9.1`
`cifs-utils` openSUSE:Leap Micro 5.2	All versions	`6.9-150100.5.18.1`

Products include Debian Debian Linux, Fedoraproject Fedora, Samba Cifs-Utils.

How do I fix CVE-2022-29869?

Apply the vendor's patch.

Is CVE-2022-29869 being exploited?

There is no known exploitation of CVE-2022-29869 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2022-29869, AZL-9588, CLSA-2026-1778015406, DEBIAN-CVE-2022-29869, GHSA-pwjc-pm2q-cpg2, SUSE-SU-2022:2801-1 and 4 more.