CVE-2015-5296
samba: client requesting encryption vulnerable to downgrade attack
Loading…
Severity
ModerateRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · December 16, 2015
Updated · June 27, 2026
Description
A man-in-the-middle vulnerability was found in the way "connection signing" was implemented by Samba. A remote attacker could use this flaw to downgrade an existing Samba client connection and force the use of plain text.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 5.8AV:N/AC:M/Au:N/C:P/I:P/A:N
CWE-345 · Insufficient Verification of Data Authenticity