{"id":"CLSA-2026-1781181291","summary":"Fix CVE(s): CVE-2026-4408","details":"   * SECURITY UPDATE: shell injection in \"check password script\" via %u\n     substitution. Samba did not sanitize or quote the username before\n     substituting it into the configured check password script, allowing\n     crafted usernames containing shell metacharacters to inject arbitrary\n     commands executed by smbd.\n     - debian/patches/CVE-2026-4408.patch\n     - CVE-2026-4408","modified":"2026-10-26T09:32:05.178925678Z","published":"2026-06-11T12:35:13Z","upstream":["CVE-2026-4408"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1781181291.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4408"}],"affected":[{"package":{"name":"ctdb","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/ctdb?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"libnss-winbind","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libnss-winbind?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"libpam-winbind","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpam-winbind?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"libsmbclient","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libsmbclient?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"libsmbclient-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libsmbclient-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"libwbclient-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libwbclient-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"libwbclient0","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libwbclient0?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"python3-samba","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/python3-samba?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"registry-tools","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/registry-tools?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"samba","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/samba?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"samba-common","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/samba-common?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"samba-common-bin","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/samba-common-bin?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"samba-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/samba-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"samba-dsdb-modules","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/samba-dsdb-modules?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"samba-libs","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/samba-libs?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"samba-testsuite","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/samba-testsuite?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"samba-vfs-modules","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/samba-vfs-modules?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"smbclient","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/smbclient?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}},{"package":{"name":"winbind","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/winbind?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781181291.json"}}],"schema_version":"1.9.0"}