CVE-2022-2031
samba: kpasswd authentication with canonicalization enabled against Samba AD DC with Heimdal returns a krbtgt
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 27, 2022
Updated · November 22, 2025
Description
A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services.
Statement
Red Hat products are not affected by this flaw, as Samba is built with MIT Kerberos instead of Heimdal Kerberos.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-288 · Authentication Bypass Using an Alternate Path or Channel