samba: The DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC
Published Dec 10, 2019
5.4
MEDIUMCVSS 3.1
EPSS 2.78%
Description
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set.
Affected products
-
- Version all versions 4.10.x before 4.10.11StatusaffectedConstraints-
- Version all versions 4.11.x before 4.11.3StatusaffectedConstraints-
- Version all versions 4.x.x before 4.9.17StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
Configuration 1
Configuration 2
- 30
- 31
Configuration 3
- 14.04
- 16.04
- 18.04
- 19.04
- 19.10
Configuration 4
- 9.0
- 10.0
No data.
Red Hat Enterprise Linux 6
samba
Not affected
Red Hat Enterprise Linux 6
samba4
Not affected
Red Hat Enterprise Linux 7
samba
Not affected
Red Hat Enterprise Linux 8
samba
Not affected
Red Hat Storage 3
samba
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | samba | Not affected | n/a |
| Red Hat Enterprise Linux 6 | samba4 | Not affected | n/a |
| Red Hat Enterprise Linux 7 | samba | Not affected | n/a |
| Red Hat Enterprise Linux 8 | samba | Not affected | n/a |
| Red Hat Storage 3 | samba | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This flaw does not affect the version of samba shipped with Red Hat Enterprise Linux because there is no support for samba as Active Directory Domain Controller.
Red Hat mitigation
Only clients configured directly in LDAP or via a Windows tools could have been marked as sensitive and so have been expected to have this protection. Therefore most Samba sites will not have been using this feature and so are not impacted either way.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
AV:N/AC:L/Au:N/C:P/I:P/A:N
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
- EPSS v4
Percentile over time
- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
- EPSS v4
Table of values (28 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 3, 2026 | 2.78% (0.02783) | 85.91th | v5 (v2026.06.15) |
| Jun 15, 2026 | 2.78% (0.02783) | 84.47th | v5 (v2026.06.15) |
| Dec 28, 2025 | 4.67% (0.04669) | 88.97th | v4 (v2025.03.14) |
| Dec 27, 2025 | 2.49% (0.02491) | 84.96th | v4 (v2025.03.14) |
| Nov 21, 2025 | 4.67% (0.04669) | 88.84th | v4 (v2025.03.14) |
| Nov 18, 2025 | 8.82% (0.08820) | 91.68th | v4 (v2025.03.14) |
| Oct 28, 2025 | 4.67% (0.04669) | 88.81th | v4 (v2025.03.14) |
| Oct 27, 2025 | 2.49% (0.02491) | 84.79th | v4 (v2025.03.14) |
| Oct 1, 2025 | 4.67% (0.04669) | 88.90th | v4 (v2025.03.14) |
| Apr 18, 2025 | 2.95% (0.02946) | 85.69th | v4 (v2025.03.14) |
| Mar 30, 2025 | 4.46% (0.04456) | 88.02th | v4 (v2025.03.14) |
| Mar 29, 2025 | 7.48% (0.07481) | 85.99th | v4 (v2025.03.14) |
| Mar 17, 2025 | 4.46% (0.04456) | 88.32th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.31% (0.00308) | 70.76th | v3 (v2023.03.01) |
| Nov 8, 2023 | 0.24% (0.00243) | 62.03th | v3 (v2023.03.01) |
| Oct 8, 2023 | 0.17% (0.00171) | 53.81th | v3 (v2023.03.01) |
| Sep 3, 2023 | 0.24% (0.00235) | 60.91th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.22% (0.00218) | 57.94th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.55% (0.01547) | 74.98th | v2 (v2022.01.01) |
| Apr 1, 2022 | 1.28% (0.01282) | 65.91th | v2 (v2022.01.01) |
| Feb 4, 2022 | 15.38% (0.15380) | 92.52th | v2 (v2022.01.01) |
| Feb 3, 2022 | 10.22% (0.10225) | 87.52th | v1 |
| Jan 6, 2022 | 10.22% (0.10225) | 87.37th | v1 |
| Jan 5, 2022 | 2.48% (0.02476) | 79.39th | v1 |
| Jun 8, 2021 | 2.48% (0.02476) | 0.00th | v1 |
| Jun 2, 2021 | 10.22% (0.10225) | 0.00th | v1 |
| Jun 1, 2021 | 2.48% (0.02476) | 0.00th | v5 (v2026.06.15) |
| Apr 14, 2021 | 2.27% (0.02273) | 0.00th | v1 |
References (18)
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html vendor-advisoryMailing ListThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2019-14870 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1778589 Issue Tracking
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14870 Issue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html mailing-listMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00034.html mailing-listMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJH3ROOFYMOATD2UEPC47P5RPBDTY77E/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNKA4YIPV7AZR7KK3GW6L3HKGHSGJZFE/ vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-14870
- https://security.gentoo.org/glsa/202003-52 vendor-advisoryThird Party Advisory
- https://security.gentoo.org/glsa/202310-06 vendor-advisory
- https://security.netapp.com/advisory/ntap-20191210-0002/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230216-0008/
- https://usn.ubuntu.com/4217-1/ vendor-advisoryThird Party Advisory
- https://usn.ubuntu.com/4217-2/ vendor-advisoryThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-14870
- https://www.samba.org/samba/security/CVE-2019-14870.html Vendor Advisory
- https://www.synology.com/security/advisory/Synology_SA_19_40 Third Party Advisory
Change history (0)
No recorded changes yet.