From 097fa693ded841cf81ffaf143f3501aa1ff45892 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 5 Dec 2022 21:31:37 +0100 Subject: [PATCH] CVE-2022-37966 docs-xml/smbdotconf: "kerberos encryption types = legacy" should not be used BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher Reviewed-by: Andrew Bartlett Reviewed-by: Ralph Boehme (cherry picked from commit a4f6f51cbed53775cdfedc7eec2f28c7beb875cc) --- .../smbdotconf/security/kerberosencryptiontypes.xml | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/docs-xml/smbdotconf/security/kerberosencryptiontypes.xml b/docs-xml/smbdotconf/security/kerberosencryptiontypes.xml index 2c3c6c5d5fc..a245af55f5f 100644 --- a/docs-xml/smbdotconf/security/kerberosencryptiontypes.xml +++ b/docs-xml/smbdotconf/security/kerberosencryptiontypes.xml @@ -37,15 +37,9 @@ When set to legacy, only RC4-HMAC-MD5 - is allowed. Avoiding AES this way has one a very specific use. - Normally, the encryption type is negotiated between the peers. - However, there is one scenario in which a Windows read-only domain - controller (RODC) advertises AES encryption, but then proxies the - request to a writeable DC which may not support AES encryption, - leading to failure of the handshake. Setting this parameter to - legacy would cause samba not to negotiate AES - encryption. It is assumed of course that the weaker legacy - encryption types are acceptable for the setup. + is allowed. AVOID using this option, because of + CVE-2022-37966 see + https://bugzilla.samba.org/show_bug.cgi?id=15237. -- 2.47.2