CVE-2023-0614 Information disclosure in Samba

High 7.7 Published 3 Apr 2023 Updated 13 Feb 2025

An attacker can obtain confidential BitLocker recovery keys from a Samba AD DC due to insufficient filtering in LDAP queries.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-0614?

CVE-2023-0614 is a high-severity vulnerability in Samba Samba, published on 3 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.

Weakness: CWE-312, CWE-200

Which versions are affected by CVE-2023-0614?

It affects 1 product.

Linux distribution packages (1)

ldb openSUSE:Tumbleweed All versions 2.7.2-1.1

Products include Samba Samba.

How do I fix CVE-2023-0614?

Apply the vendor's patch.

Is CVE-2023-0614 being exploited?

There is no known exploitation of CVE-2023-0614 in the wild and no public exploit code.

All Samba Samba vulnerabilities

Sources

Also known as AZL-26697, AZL-37019, DEBIAN-CVE-2023-0614, ECHO-e514-9869-08ff, GHSA-8pwj-3gh6-824j, OESA-2023-1220 and 4 more.