From mboxrd@z Thu Jan 1 00:00:00 1970 From: Adolf Belka To: development@lists.ipfire.org Subject: Re: [PATCH] samba: Update to 4.19.2 Date: Thu, 19 Oct 2023 23:36:17 +0200 Message-ID: <7f30373f-861b-4f47-b378-d8dc6ded2022@ipfire.org> In-Reply-To: <20231019170324.3594584-1-matthias.fischer@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4692711920991697336==" List-Id: --===============4692711920991697336== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Reviewed-by: Adolf Belka On 19/10/2023 19:03, Matthias Fischer wrote: > For details see: > > v4.19.1. =3D> https://www.samba.org/samba/history/samba-4.19.1.html > " > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > Release Notes for Samba 4.19.1 > October 10, 2023 > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > This is a security release in order to address the following defects: > > o CVE-2023-3961: Unsanitized pipe names allow SMB clients to connect as ro= ot to > existing unix domain sockets on the file system. > https://www.samba.org/samba/security/CVE-2023-3961.html > > o CVE-2023-4091: SMB client can truncate files to 0 bytes by opening files= with > OVERWRITE disposition when using the acl_xattr Samba VFS > module with the smb.conf setting > "acl_xattr:ignore system acls =3D yes" > https://www.samba.org/samba/security/CVE-2023-4091.html > > o CVE-2023-4154: An RODC and a user with the GET_CHANGES right can view all > attributes, including secrets and passwords. Additional= ly, > the access check fails open on error conditions. > https://www.samba.org/samba/security/CVE-2023-4154.html > > o CVE-2023-42669: Calls to the rpcecho server on the AD DC can request that= the > server block for a user-defined amount of time, denying > service. > https://www.samba.org/samba/security/CVE-2023-42669.html > > o CVE-2023-42670: Samba can be made to start multiple incompatible RPC > listeners, disrupting service on the AD DC. > https://www.samba.org/samba/security/CVE-2023-42670.html" > > v4.19.2 =3D> https://www.samba.org/samba/history/samba-4.19.2.html > "Changes since 4.19.1 > -------------------- > > o Jeremy Allison > * BUG 15423: Use-after-free in aio_del_req_from_fsp during smbd shutdown > after failed IPC FSCTL_PIPE_TRANSCEIVE. > * BUG 15426: clidfs.c do_connect() missing a "return" after a cli_shutd= own() > call. > > o Ralph Boehme > * BUG 15463: macOS mdfind returns only 50 results. > > o Volker Lendecke > * BUG 15481: GETREALFILENAME_CACHE can modify incoming new filename with > previous cache entry value. > > o Stefan Metzmacher > * BUG 15464: libnss_winbind causes memory corruption since samba-4.18, > impacts sendmail, zabbix, potentially more. > > o Martin Schwenke > * BUG 15479: ctdbd: setproctitle not initialized messages flooding logs. > > o Joseph Sutton > * BUG 15491: CVE-2023-5568 Heap buffer overflow with freshness tokens i= n the > Heimdal KDC in Samba 4.19 > * BUG 15477: The heimdal KDC doesn't detect s4u2self correctly when fas= t is > in use." > > Signed-off-by: Matthias Fischer > --- > config/rootfiles/packages/x86_64/samba | 1 - > lfs/samba | 6 +++--- > 2 files changed, 3 insertions(+), 4 deletions(-) > > diff --git a/config/rootfiles/packages/x86_64/samba b/config/rootfiles/pack= ages/x86_64/samba > index 4e5cee3a8..7a44b9cdb 100644 > --- a/config/rootfiles/packages/x86_64/samba > +++ b/config/rootfiles/packages/x86_64/samba > @@ -923,7 +923,6 @@ usr/libexec/samba/rpcd_epmapper > usr/libexec/samba/rpcd_fsrvp > usr/libexec/samba/rpcd_lsad > usr/libexec/samba/rpcd_mdssvc > -usr/libexec/samba/rpcd_rpcecho > usr/libexec/samba/rpcd_spoolss > usr/libexec/samba/rpcd_winreg > usr/libexec/samba/samba-bgqd > diff --git a/lfs/samba b/lfs/samba > index 77bb569cd..2f2184ecc 100644 > --- a/lfs/samba > +++ b/lfs/samba > @@ -24,7 +24,7 @@ > =20 > include Config > =20 > -VER =3D 4.19.0 > +VER =3D 4.19.2 > SUMMARY =3D A SMB/CIFS File, Print, and Authentication Server > =20 > THISAPP =3D samba-$(VER) > @@ -33,7 +33,7 @@ DL_FROM =3D $(URL_IPFIRE) > DIR_APP =3D $(DIR_SRC)/$(THISAPP) > TARGET =3D $(DIR_INFO)/$(THISAPP) > PROG =3D samba > -PAK_VER =3D 96 > +PAK_VER =3D 97 > =20 > DEPS =3D avahi cups perl-Parse-Yapp perl-JSON > =20 > @@ -47,7 +47,7 @@ objects =3D $(DL_FILE) > =20 > $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE) > =20 > -$(DL_FILE)_BLAKE2 =3D 4e0db41d7d06e195cee994c5ec02a37892c1a7dd99ea9defb845= fe2fbf96446846c469007218b6b0d6077c0886f0d08b2a4376acba1ed455b641daacd9018f12 > +$(DL_FILE)_BLAKE2 =3D cb3747f1be6e712c6e68f3720e68aee7db2e4dcc48a9210d0023= 37d6690ed8b027919f333dc4a7c1e74b716ebceeff1d8071463899513edfe51da967d71d8148 > =20 > install : $(TARGET) > =20 --=20 Sent from my laptop --===============4692711920991697336==--