From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: Re: [Announce] Samba 4.14.2 (4.14.1), 4.13.7 (4.13.6) and 4.12.14 (4.12.13) Security Releases Date: Thu, 01 Apr 2021 11:15:25 +0100 Message-ID: <2474D275-BF67-40FD-A373-A3AD92E584F8@ipfire.org> In-Reply-To: <94d216bd-28ef-ff30-8220-c3a56a449cbd@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6934720272447045216==" List-Id: --===============6934720272447045216== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello, Sorry for all those late replies=E2=80=A6 I am working through my inbox going= backwards :) > On 26 Mar 2021, at 14:18, Adolf Belka wrote: >=20 > Hi Michael, >=20 > So the samba built with no problem but there was a change to the rootfile. >=20 > I have found that the rootfile is under separate directories for each archi= tecture. I did a diff between the x86_64 and the armv5tel and most of the dif= ferences are just the x86_64 replaced by arm but I also found files where the= filename itself is different between x86_64 and armv5tel with for instance .= ..gnu.so.2 replaced by ....gnueabi.so.2 Yes, this is quite annoying what they did there, but seems to be the current = trend with everyone who builds their own build system. > So I can do the patch with the x86_64 rootfile updated as that architecture= is what I am using for my builds. I don't know what to do with the others. A= re those automatically updated based on mine or do I have to do something to = get them updated and if so then what? Just submit this as x86_64 and I will take care of the rest. I will either ju= st merge it and pull the files from the nightly builders after the first buil= d is done or build them manually on the appropriate architectures. Depending = on what I find easier. Best, -Michael > Regards, > Adolf. >=20 > On 25/03/2021 18:50, Michael Tremer wrote: >> Great! Thank you. >>> On 25 Mar 2021, at 14:44, Adolf Belka wrote: >>>=20 >>> Hi. >>>=20 >>> I will pick it up. >>>=20 >>> Adolf. >>>=20 >>>=20 >>>=20 >>> On 25/03/2021 10:41, Michael Tremer wrote: >>>> Is anyone up for grabbing this? >>>>=20 >>>> We should not be affected by these security issues, but I do not see any= reasons why we should not update - just in case. >>>>=20 >>>> -Michael >>>>=20 >>>>> Begin forwarded message: >>>>>=20 >>>>> From: Karolin Seeger via samba-announce >>>>> Subject: [Announce] Samba 4.14.2 (4.14.1), 4.13.7 (4.13.6) and 4.12.14 = (4.12.13) Security Releases >>>>> Date: 24 March 2021 at 12:02:14 GMT >>>>> To: samba-announce(a)lists.samba.org, samba(a)lists.samba.org, samba-te= chnical(a)lists.samba.org >>>>> Reply-To: kseeger(a)samba.org >>>>>=20 >>>>> Release Announcements >>>>> --------------------- >>>>>=20 >>>>> These are security releases in order to address the following defects: >>>>>=20 >>>>> o CVE-2020-27840: Heap corruption via crafted DN strings. >>>>> o CVE-2021-20277: Out of bounds read in AD DC LDAP server. >>>>>=20 >>>>>=20 >>>>> =3D=3D=3D=3D=3D=3D=3D >>>>> Details >>>>> =3D=3D=3D=3D=3D=3D=3D >>>>>=20 >>>>> o CVE-2020-27840: >>>>> An anonymous attacker can crash the Samba AD DC LDAP server by sendin= g easily >>>>> crafted DNs as part of a bind request. More serious heap corruption i= s likely >>>>> also possible. >>>>>=20 >>>>> o CVE-2021-20277: >>>>> User-controlled LDAP filter strings against the AD DC LDAP server may= crash >>>>> the LDAP server. >>>>>=20 >>>>> For more details, please refer to the security advisories. >>>>>=20 >>>>>=20 >>>>> ####################################### >>>>> Reporting bugs & Development Discussion >>>>> ####################################### >>>>>=20 >>>>> Please discuss this release on the samba-technical mailing list or by >>>>> joining the #samba-technical IRC channel on irc.freenode.net. >>>>>=20 >>>>> If you do report problems then please try to send high quality >>>>> feedback. If you don't provide vital information to help us track down >>>>> the problem then you will probably be ignored. All bug reports should >>>>> be filed under the Samba 4.1 and newer product in the project's Bugzilla >>>>> database (https://bugzilla.samba.org/). >>>>>=20 >>>>>=20 >>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>> =3D=3D Our Code, Our Bugs, Our Responsibility. >>>>> =3D=3D The Samba Team >>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>=20 >>>>>=20 >>>>>=20 >>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>> Download Details >>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>=20 >>>>> The uncompressed tarballs and patch files have been signed >>>>> using GnuPG (ID AA99442FB680B620). The source code can be downloaded >>>>> from: >>>>>=20 >>>>> https://download.samba.org/pub/samba/stable/ >>>>>=20 >>>>> The release notes are available online at: >>>>>=20 >>>>> https://www.samba.org/samba/history/samba-4.14.2.html >>>>> https://www.samba.org/samba/history/samba-4.13.7.html >>>>> https://www.samba.org/samba/history/samba-4.12.14.html >>>>>=20 >>>>> Our Code, Our Bugs, Our Responsibility. >>>>> (https://bugzilla.samba.org/) >>>>>=20 >>>>> --Enjoy >>>>> The Samba Team >>>>=20 >>> --=20 >>> Sent from my laptop >>>=20 --===============6934720272447045216==--