PT-2022-7528 · Gnutls+8 · Gnutls+8

Douglas Bagnall · Published 2022-06-21 · Updated 2025-10-01 · CVE-2022-1615

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Samba (affected versions not specified)

Description The issue is related to the function gnutls rnd() in the GnuTLS package used by Samba, which generates insufficiently random values. This can potentially allow an attacker to gain access to confidential data. The function gnutls rnd() can fail, resulting in predictable random values.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

ALSA-2023:2519

ALSA-2023:2987

AZL-10864

BDU:2024-06955

CESA-2023_2987

CVE-2022-1615

OESA-2022-1905

OPENSUSE-SU-2022_3244-1

OPENSUSE-SU-2022_3955-1

RHSA-2023:2519

RHSA-2023:2987

RHSA-2023_2519

RHSA-2023_2987

RHSA-2024:0423

SUSE-SU-2022:3244-1

SUSE-SU-2022:3270-1

SUSE-SU-2022:3955-1

SUSE-SU-2022:4014-1

SUSE-SU-2022_3244-1

SUSE-SU-2022_3270-1

SUSE-SU-2022_3955-1

Affected Products

Almalinux

Astra Linux

Centos

Debian

Gnutls

Red Hat

Red Os

Samba

Suse

References · 48

• 🔥 https://bugzilla.samba.org/show_bug.cgi?id=15103 · Exploit
• https://errata.almalinux.org/9/ALSA-2023-2519.html · Vendor Advisory
• https://gitlab.com/samba-team/samba/-/merge_requests/2644 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1615 · Security Note
• https://linux.oracle.com/errata/ELSA-2023-2987.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:2519 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-1615 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-1615 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1615 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTTOLTHUHOV4SHCHCB5TAA4FQVJAWN4P · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1615 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2023-2987.html · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-10864 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory