{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/debian10els/vex/2022/cve-2022-29869-els_os-debian10els.json" } ], "tracking": { "current_release_date": "2026-10-23T22:33:31Z", "generator": { "date": "2026-10-23T22:33:31Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2022-29869-ELS_OS-DEBIAN10ELS", "initial_release_date": "2022-04-28T01:15:00Z", "revision_history": [ { "date": "2022-04-28T01:15:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-23T22:33:31Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2022-29869" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 10", "product": { "name": "Debian 10", "product_id": "Debian-10", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:10:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" }, { "branches": [ { "category": "product_version", "name": "cifs-utils-2:6.8-2+deb10u1.armel", "product": { "name": "cifs-utils-2:6.8-2+deb10u1.armel", "product_id": "cifs-utils-2:6.8-2+deb10u1.armel", "product_identification_helper": { "purl": "pkg:deb/debian/cifs-utils@2:6.8-2%2Bdeb10u1?arch=armel" } } } ], "category": "architecture", "name": "armel" }, { "branches": [ { "category": "product_version", "name": "cifs-utils-2:6.8-2+deb10u1.amd64", "product": { "name": "cifs-utils-2:6.8-2+deb10u1.amd64", "product_id": "cifs-utils-2:6.8-2+deb10u1.amd64", "product_identification_helper": { "purl": "pkg:deb/debian/cifs-utils@2:6.8-2%2Bdeb10u1?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "cifs-utils-2:6.8-2+deb10u1.arm64", "product": { "name": "cifs-utils-2:6.8-2+deb10u1.arm64", "product_id": "cifs-utils-2:6.8-2+deb10u1.arm64", "product_identification_helper": { "purl": "pkg:deb/debian/cifs-utils@2:6.8-2%2Bdeb10u1?arch=arm64" } } } ], "category": "architecture", "name": "arm64" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.armel", "product": { "name": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.armel", "product_id": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cifs-utils@2:6.8-2%2Bdeb10u1%2Btuxcare.els1?arch=armel" } } } ], "category": "architecture", "name": "armel" }, { "branches": [ { "category": "product_version", "name": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.amd64", "product": { "name": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.amd64", "product_id": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cifs-utils@2:6.8-2%2Bdeb10u1%2Btuxcare.els1?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.arm64", "product": { "name": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.arm64", "product_id": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cifs-utils@2:6.8-2%2Bdeb10u1%2Btuxcare.els1?arch=arm64" } } } ], "category": "architecture", "name": "arm64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.armel as a component of Debian 10", "product_id": "Debian-10:cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.armel" }, "product_reference": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.armel", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "cifs-utils-2:6.8-2+deb10u1.armel as a component of Debian 10", "product_id": "Debian-10:cifs-utils-2:6.8-2+deb10u1.armel" }, "product_reference": "cifs-utils-2:6.8-2+deb10u1.armel", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.amd64" }, "product_reference": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "cifs-utils-2:6.8-2+deb10u1.amd64 as a component of Debian 10", "product_id": "Debian-10:cifs-utils-2:6.8-2+deb10u1.amd64" }, "product_reference": "cifs-utils-2:6.8-2+deb10u1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.arm64 as a component of Debian 10", "product_id": "Debian-10:cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.arm64" }, "product_reference": "cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "cifs-utils-2:6.8-2+deb10u1.arm64 as a component of Debian 10", "product_id": "Debian-10:cifs-utils-2:6.8-2+deb10u1.arm64" }, "product_reference": "cifs-utils-2:6.8-2+deb10u1.arm64", "relates_to_product_reference": "Debian-10" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-29869", "cwe": { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File" }, "notes": [ { "category": "description", "text": "cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "Debian-10:cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.amd64", "Debian-10:cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.arm64", "Debian-10:cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.armel", "Debian-10:cifs-utils-2:6.8-2+deb10u1.amd64", "Debian-10:cifs-utils-2:6.8-2+deb10u1.arm64", "Debian-10:cifs-utils-2:6.8-2+deb10u1.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-29869" }, { "category": "external", "summary": "https://github.com/piastry/cifs-utils/commit/8acc963a2e7e9d63fe1f2e7f73f5a03f83d9c379", "url": "https://github.com/piastry/cifs-utils/commit/8acc963a2e7e9d63fe1f2e7f73f5a03f83d9c379" }, { "category": "external", "summary": "https://github.com/piastry/cifs-utils/pull/7", "url": "https://github.com/piastry/cifs-utils/pull/7" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2022/05/msg00020.html", "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00020.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WBOLMANBYJILXQKRRK7OCR774PXJAYY/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WBOLMANBYJILXQKRRK7OCR774PXJAYY/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXKZLJYJJEC3TIBFLXUORRMZUKG5W676/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXKZLJYJJEC3TIBFLXUORRMZUKG5W676/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIYZ4L6SLSYJQ446VJAO2VGAESURQNSP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIYZ4L6SLSYJQ446VJAO2VGAESURQNSP/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202311-05", "url": "https://security.gentoo.org/glsa/202311-05" }, { "category": "external", "summary": "https://www.debian.org/security/2022/dsa-5157", "url": "https://www.debian.org/security/2022/dsa-5157" } ], "release_date": "2022-04-28T01:15:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-06-19T12:01:03.666590Z", "details": "This issue only triggers when mount.cifs is run with verbose logging enabled and it parses a non-credentials file that contains “=” via the credentials= option; verbose logging is disabled by default and invoking mount.cifs or changing its options typically requires elevated privileges or an explicit fstab allowance. Any exposure is limited to the client’s local logs (no integrity or availability impact), so it is not practically network‑exploitable without the ability to influence mount options and read those logs, making it a low‑priority risk in centrally managed server/VM deployments.", "product_ids": [ "Debian-10:cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.amd64", "Debian-10:cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.arm64", "Debian-10:cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.armel", "Debian-10:cifs-utils-2:6.8-2+deb10u1.amd64", "Debian-10:cifs-utils-2:6.8-2+deb10u1.arm64", "Debian-10:cifs-utils-2:6.8-2+deb10u1.armel" ] } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Debian-10:cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.amd64", "Debian-10:cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.arm64", "Debian-10:cifs-utils-2:6.8-2+deb10u1+tuxcare.els1.armel", "Debian-10:cifs-utils-2:6.8-2+deb10u1.amd64", "Debian-10:cifs-utils-2:6.8-2+deb10u1.arm64", "Debian-10:cifs-utils-2:6.8-2+deb10u1.armel" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }