CVE-2019-14833 log

Source
Severity Medium
Remote Yes
Type Insufficient validation
Description
A security issue has been found in Samba before 4.10.10, where the check password script does not receive the full password string when the password contains multi-byte (non-ASCII) characters.
Since Samba Version 4.5.0 a Samba AD DC can use a custom command to verify the password complexity. The command can be specified with the "check password script" smb.conf parameter. This command is called when Samba handles a user password change or a new user password is set. The script receives the new cleartext password string in order to run custom password complexity checks like dictionary checks to avoid weak user passwords. If the check password script parameter is not specified, Samba runs the internal password quality checks. The internal check makes sure that a password contains characters from three of five different characters categories.
Group Package Affected Fixed Severity Status Ticket
AVG-1057 samba 4.10.8-2 4.10.10-1 Medium Fixed
Date Advisory Group Package Severity Description
03 Nov 2019 ASA-201911-6 AVG-1057 samba Medium multiple issues
References
https://www.samba.org/samba/security/CVE-2019-14833.html
https://download.samba.org/pub/samba/patches/security/samba-4.10.9-security-2019-10-29.patch