# CVE-2021-3882: ledgersmb: LedgerSMB does not set the 'Secure' attribute on the session authorizationcookie when the client uses HTTPS and the L...

CVE-2021-3882 is fixed in ledgersmb on 1 platform, first by ledgersmb 1.6.9+ds-1ubuntu0.1+esm1, released February 2, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2021-3882
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0113
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 14, 2021

## Description

LedgerSMB does not set the 'Secure' attribute on the session authorizationcookie when the client uses HTTPS and the LedgerSMB server is behind areverse proxy. By tricking a user to use an unencrypted connection (HTTP),an attacker may be able to obtain the authentication data by capturingnetwork traffic. LedgerSMB 1.8 and newer switched from Basic authenticationto using cookie authentication with encrypted cookies. Although an attackercan't access the information inside the cookie, nor the password of theuser, possession of the cookie is enough to access the application as theuser from which the cookie has been obtained. In order for the attacker toobtain the cookie, first of all the server must be configured to respond tounencrypted requests, the attacker must be suitably positioned to eavesdropon the network traffic between the client and the server *and* the usermust be tricked into using unencrypted HTTP traffic. Proper audit controland separation of duties limit Integrity impact of the attack vector. Usersof LedgerSMB 1.8 are urged to upgrade to known-fixed versions. Users ofLedgerSMB 1.7 or 1.9 are unaffected by this vulnerability and don't need totake action. As a workaround, users may configure their Apache or Nginxreverse proxy to add the Secure attribute at the network boundary insteadof relying on LedgerSMB. For Apache, please refer to the 'Header alwaysedit' configuration command in the mod_headers module. For Nginx, pleaserefer to the 'proxy_cookie_flags' configuration command.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | ledgersmb Ubuntu 20.04 LTS (focal) | 1.6.9+ds-1ubuntu0.1+esm1 | [ledgersmb 1.6.9+ds-1ubuntu0.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-ledgersmb-1.6.9-ds-1ubuntu0.1-esm1.md) | Feb 2, 2024 |
| Linux | ledgersmb Ubuntu 22.04.1 LTS (jammy) | 1.6.33+ds-1ubuntu0.1 | [ledgersmb 1.6.33+ds-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ledgersmb-1.6.33-ds-1ubuntu0.1.md) | Feb 2, 2024 |
| Linux | ledgersmb Ubuntu 24.04.5 LTS (noble) | 1.6.33+ds-2.1ubuntu0.1 | [ledgersmb 1.6.33+ds-2.1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ledgersmb-1.6.33-ds-2.1ubuntu0.1.md) | Feb 2, 2024 |
| Linux | ledgersmb Ubuntu 25.04 (plucky) | 1.6.33+ds-2.2ubuntu0.25.04.1 | [ledgersmb 1.6.33+ds-2.2ubuntu0.25.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-ledgersmb-1.6.33-ds-2.2ubuntu0.25.04.1.md) | Jan 16, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.