CVE-2022-45141 Weak cryptography in Samba

Critical 9.8 Published 6 Mar 2023 Updated 6 Mar 2025

Samba Active Directory Domain Controllers issue weak RC4-HMAC encrypted tickets, enabling potential privilege escalation and security bypass.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-45141?

CVE-2022-45141 is a critical vulnerability in Samba Samba, published on 6 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).

Weakness: CWE-326, CWE-328

Which versions are affected by CVE-2022-45141?

It affects 1 product.

Products include Samba Samba.

How do I fix CVE-2022-45141?

Apply the vendor's patch.

Is CVE-2022-45141 being exploited?

There is no known exploitation of CVE-2022-45141 in the wild and no public exploit code.

All Samba Samba vulnerabilities

Sources

Also known as ALPINE-CVE-2022-45141, AZL-25602, AZL-37018, CLSA-2023-1679000956, CLSA-2023-1685971623, CLSA-2025-1761082525 and 6 more.