From: Karolin Seeger <kseeger@samba.org>
Date: Wed, 13 Sep 2017 16:39:40 +0000 (-0700)
Subject: WHATSNEW: Add release notes for Samba 4.5.14.
X-Git-Tag: samba-4.5.14~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bb90fee8f63afa6b9f77f892810e19b153239f24;p=thirdparty%2Fsamba.git

WHATSNEW: Add release notes for Samba 4.5.14.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
---

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index f3fccf713b7..ea845c3b719 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,3 +1,77 @@
+                   ==============================
+                   Release Notes for Samba 4.5.14
+                         September 20, 2017
+                   ==============================
+
+
+This is a security release in order to address the following defects:
+
+o  CVE-2017-12150 (SMB1/2/3 connections may not require signing where they
+   should)
+o  CVE-2017-12151 (SMB3 connections don't keep encryption across DFS redirects)
+o  CVE-2017-12163 (Server memory information leak over SMB1)
+
+
+=======
+Details
+=======
+
+o  CVE-2017-12150:
+   A man in the middle attack may hijack client connections.
+
+o  CVE-2017-12151:
+   A man in the middle attack can read and may alter confidential
+   documents transferred via a client connection, which are reached
+   via DFS redirect when the original connection used SMB3.
+
+o  CVE-2017-12163:
+   Client with write access to a share can cause server memory contents to be
+   written into a file or printer.
+
+For more details and workarounds, please see the security advisories:
+
+   o https://www.samba.org/samba/security/CVE-2017-12150.html
+   o https://www.samba.org/samba/security/CVE-2017-12151.html
+   o https://www.samba.org/samba/security/CVE-2017-12163.html
+
+
+Changes since 4.5.13:
+---------------------
+
+o  Jeremy Allison <jra@samba.org>
+   * BUG 13020: CVE-2017-12163: s3:smbd: Prevent client short SMB1 write from
+     writing server memory to file.
+
+o  Stefan Metzmacher <metze@samba.org>
+   * BUG 12996: CVE-2017-12151: Keep required encryption across SMB3 dfs
+     redirects.
+   * BUG 12997: CVE-2017-12150: Some code path don't enforce smb signing
+     when they should.
+
+
+#######################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored.  All bug reports should
+be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
                    ==============================
                    Release Notes for Samba 4.5.13
                            August 31, 2017
@@ -61,8 +135,8 @@ database (https://bugzilla.samba.org/).
 ======================================================================
 
 
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
+
 
                    ==============================
                    Release Notes for Samba 4.5.12