]> git.ipfire.org Git - ipfire-2.x.git/commit
samba: Update to version 4.18.5
authorAdolf Belka <adolf.belka@ipfire.org>
Tue, 25 Jul 2023 14:37:17 +0000 (16:37 +0200)
committerMichael Tremer <michael.tremer@ipfire.org>
Wed, 26 Jul 2023 13:15:52 +0000 (13:15 +0000)
commit05fb9ba088b37ac5d87bc6b2aed2b66e5be90d2c
tree92132b7647c02e5188d606a1b2c66a73830c53b6
parent4742a8032fcdd9d892b899dbe7ed42ada67644ca
samba: Update to version 4.18.5

- Update from version 4.18.4 to 4.18.5
- Update of rootfile not required
- Changelog
    4.18.5
      This is a security release in order to address the following defects:
o CVE-2022-2127:  When winbind is used for NTLM authentication, a maliciously
                  crafted request can trigger an out-of-bounds read in winbind
                  and possibly crash it.
                  https://www.samba.org/samba/security/CVE-2022-2127.html
o CVE-2023-3347:  SMB2 packet signing is not enforced if an admin configured
                  "server signing = required" or for SMB2 connections to Domain
                  Controllers where SMB2 packet signing is mandatory.
                  https://www.samba.org/samba/security/CVE-2023-3347.html
o CVE-2023-34966: An infinite loop bug in Samba's mdssvc RPC service for
                  Spotlight can be triggered by an unauthenticated attacker by
                  issuing a malformed RPC request.
                  https://www.samba.org/samba/security/CVE-2023-34966.html
o CVE-2023-34967: Missing type validation in Samba's mdssvc RPC service for
                  Spotlight can be used by an unauthenticated attacker to
                  trigger a process crash in a shared RPC mdssvc worker process.
                  https://www.samba.org/samba/security/CVE-2023-34967.html
o CVE-2023-34968: As part of the Spotlight protocol Samba discloses the server-
                  side absolute path of shares and files and directories in
                  search results.
                  https://www.samba.org/samba/security/CVE-2023-34968.html
o  Ralph Boehme <slow@samba.org>
   * BUG 15072: CVE-2022-2127.
   * BUG 15340: CVE-2023-34966.
   * BUG 15341: CVE-2023-34967.
   * BUG 15388: CVE-2023-34968.
   * BUG 15397: CVE-2023-3347.
o  Volker Lendecke <vl@samba.org>
   * BUG 15072: CVE-2022-2127.
o  Stefan Metzmacher <metze@samba.org>
   * BUG 15418: Secure channel faulty since Windows 10/11 update 07/2023.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
lfs/samba