{"id":"SUSE-SU-2022:0361-1","summary":"Security update for ldb, samba","details":"This update for ldb, samba fixes the following issues:\n\nChanges in ldb:\n\n+ CVE-2020-25718: An RODC can issue (forge) administrator\n  tickets to other servers; (bsc#1192246)\n+ CVE-2021-3738: Fixed a crash in dsdb stack (bsc#1192215)\n\nRelease ldb 2.2.2\n\n+ Corrected python behaviour for 'in' for LDAP attributes\n  contained as part of ldb.Message\n+ Fix memory handling in ldb.msg_diff\n+ Backport bronze bit fixes, tests, and selftest improvements.\n\nChanges in samba:\n\n- CVE-2021-44142: Fixed an Out-of-Bound Read/Write on Samba vfs_fruit\n  module; (bsc#1194859)\n\n- The username map [script] advice from CVE-2020-25717 advisory\n  note has undesired side effects for the local nt token. Fallback\n  to a SID/UID based mapping if the name based lookup fails;\n  (bsc#1192849); (bso#14901).\n\n- Fix regression introduced by CVE-2020-25717 patches, winbindd\n  does not start when 'allow trusted domains' is off; (bso#14899);\n\n- CVE-2020-25717: Fixed that a user on the domain can become root on\n  domain members; (bsc#1192284); (bso#14556).\n- CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID\n  values; (bsc#1192505); (bso#14564).\n- CVE-2020-25718: An RODC can issue (forge) administrator tickets\n  to other servers; (bsc#1192246);(bso#14558).\n- CVE-2020-25719: Fixed AD DC Username based races when no PAC\n  is given;(bsc#1192247);(bso#14561).\n- CVE-2020-25722: Fixed that AD DC UPN vs samAccountName not checked\n  (top-level bug for AD DC validation issues);(bsc#1192283);\n  (bso#14564).\n- CVE-2021-3738: Fixed a crash in dsdb stack;(bsc#1192215);\n  (bso#14468).\n- CVE-2021-23192: Fixed that dcerpc requests don't check all fragments\n  against the first auth_state;(bsc#1192214);(bso#14875).\n\n- CVE-2016-2124: don't fallback to non spnego authentication if we\n  require kerberos; (bsc#1014440); (bso#12444).\n\nUpdate to 4.13.13\n\n   * rodc_rwdc test flaps;(bso#14868).\n   * Backport bronze bit fixes, tests, and selftest improvements;\n     (bso#14881).\n   * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]\n     'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba\n     with embedded Heimdal;(bso#14642).\n   * Python ldb.msg_diff() memory handling failure;(bso#14836).\n   * 'in' operator on ldb.Message is case sensitive;(bso#14845).\n   * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).\n   * Allow special chars like '@' in samAccountName when generating\n     the salt;(bso#14874).\n   * Fix transit path validation;(bso#12998).\n   * Prepare to operate with MIT krb5 \u003e= 1.20;(bso#14870).\n   * rpcclient NetFileEnum and net rpc file both cause lock order\n     violation: brlock.tdb, share_entries.tdb;(bso#14645).\n   * Python ldb.msg_diff() memory handling failure;(bso#14836).\n   * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).\n\n- Update to 4.13.12\n\n   * Address a signifcant performance regression in database access\n     in the AD DC since Samba 4.12;(bso#14806).\n   * Fix performance regression in lsa_LookupSids3/LookupNames4\n     since Samba 4.9 by using an explicit database handle cache;\n     (bso#14807).\n   * An unuthenticated user can crash the AD DC KDC by omitting the\n     server name in a TGS-REQ;(bso#14817).\n   * Address flapping samba_tool_drs_showrepl test;(bso#14818).\n   * Address flapping dsdb_schema_attributes test;(bso#14819).\n   * An unuthenticated user can crash the AD DC KDC by omitting the\n     server name in a TGS-REQ;(bso#14817).\n   * Fix CTDB flag/status update race conditions(bso#14784).\n\n- Update to 4.13.11\n\n   * smbd: panic on force-close share during offload write;\n     (bso#14769).\n   * Fix returned attributes on fake quota file handle and avoid\n     hitting the VFS;(bso#14731).\n   * smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).\n   * net conf list crashes when run as normal user;(bso#14787).\n   * Work around special SMB2 READ response behavior of NetApp Ontap\n     7.3.7;(bso#14607).\n   * Start the SMB encryption as soon as possible;(bso#14793).\n   * Winbind should not start if the socket path for the privileged\n     pipe is too long;(bso#14792).\n\n- Fix 'net rpc' authentication when using the machine account;\n  (bsc#1189017); (bso#14796);\n\n- Fix dependency problem upgrading from libndr0 to libndr1;\n  (bsc#1189875);\n- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;\n  (bsc#1189875);\n- Fix wrong kvno exported to keytab after net ads changetrustpw due\n  to replication delay; (bsc#1188727);\n- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).\n\n- Update to 4.13.10\n\n  * s3: smbd: Ensure POSIX default ACL is mapped into returned\n    Windows ACL for directory handles; (bso#14708);\n  * Take a copy to make sure we don't reference free'd memory; (bso#14721);\n  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);\n  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in\n    change_file_owner_to_parent() error path; (bso#14736);\n  * samba-tool: Give better error information when the\n    'domain backup restore' fails with a duplicate SID; (bso#14575);\n  * smbd: Correctly initialize close timestamp fields; (bso#14714);\n  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);\n  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);\n  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);\n  * smbXsrv_{open,session,tcon}: Protect\n    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);\n  * samba-tool domain backup offline doesn't work against bind DLZ\n    backend; (bso#14027);\n  * netcmd: Use next_free_rid() function to calculate a SID for\n    restoring a backup; (bso#14669);\n\n- Update to 4.13.9\n\n  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);\n  * Add documentation for dsdb_group_audit and dsdb_group_json_audit\n    to 'log level', synchronise 'log level' in smb.conf with the code; (bso#14689);\n  * Fix smbd panic when two clients open same file; (bso#14672);\n  * Fix memory leak in the RPC server; (bso#14675);\n  * s3: smbd: Fix deferred renames; (bso#14679);\n  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);\n  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);\n  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);\n  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);\n  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid\n    conflict; (bso#14663);\n  * Fix the build on OmniOS; (bso#14288);\n\n- Update to 4.13.8\n\n  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571\n\n- Update to 4.13.7\n\n  * Release with dependency on ldb version 2.2.1.\n","modified":"2026-02-04T02:13:04.762341Z","published":"2022-02-10T14:12:34Z","related":["CVE-2016-2124","CVE-2020-17049","CVE-2020-25717","CVE-2020-25718","CVE-2020-25719","CVE-2020-25721","CVE-2020-25722","CVE-2021-20254","CVE-2021-23192","CVE-2021-3738","CVE-2021-44142"],"upstream":["CVE-2016-2124","CVE-2020-17049","CVE-2020-25717","CVE-2020-25718","CVE-2020-25719","CVE-2020-25721","CVE-2020-25722","CVE-2021-20254","CVE-2021-23192","CVE-2021-3738","CVE-2021-44142"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220361-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1014440"},{"type":"REPORT","url":"https://bugzilla.suse.com/1188727"},{"type":"REPORT","url":"https://bugzilla.suse.com/1189017"},{"type":"REPORT","url":"https://bugzilla.suse.com/1189875"},{"type":"REPORT","url":"https://bugzilla.suse.com/1192214"},{"type":"REPORT","url":"https://bugzilla.suse.com/1192215"},{"type":"REPORT","url":"https://bugzilla.suse.com/1192246"},{"type":"REPORT","url":"https://bugzilla.suse.com/1192247"},{"type":"REPORT","url":"https://bugzilla.suse.com/1192283"},{"type":"REPORT","url":"https://bugzilla.suse.com/1192284"},{"type":"REPORT","url":"https://bugzilla.suse.com/1192505"},{"type":"REPORT","url":"https://bugzilla.suse.com/1192849"},{"type":"REPORT","url":"https://bugzilla.suse.com/1194859"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-2124"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-17049"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-25717"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-25718"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-25719"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-25721"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-25722"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-20254"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-23192"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-3738"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-44142"}],"affected":[{"package":{"name":"ldb","ecosystem":"SUSE:Enterprise Storage 7","purl":"pkg:rpm/suse/ldb&distro=SUSE%20Enterprise%20Storage%207"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-4.6.1"}]}],"ecosystem_specific":{"binaries":[{"ctdb":"4.13.13+git.545.5897c2d94f3-3.12.1","libdcerpc-binding0":"4.13.13+git.545.5897c2d94f3-3.12.1","libldb2":"2.2.2-4.6.1","libndr-nbt0":"4.13.13+git.545.5897c2d94f3-3.12.1","libnetapi0":"4.13.13+git.545.5897c2d94f3-3.12.1","libsmbclient0":"4.13.13+git.545.5897c2d94f3-3.12.1","libsmbconf0":"4.13.13+git.545.5897c2d94f3-3.12.1","libwbclient0":"4.13.13+git.545.5897c2d94f3-3.12.1","libsmbldap2":"4.13.13+git.545.5897c2d94f3-3.12.1","samba-ceph":"4.13.13+git.545.5897c2d94f3-3.12.1","samba-client":"4.13.13+git.545.5897c2d94f3-3.12.1","samba-libs":"4.13.13+git.545.5897c2d94f3-3.12.1","samba-winbind":"4.13.13+git.545.5897c2d94f3-3.12.1","libsamba-util0":"4.13.13+git.545.5897c2d94f3-3.12.1","libndr1":"4.13.13+git.545.5897c2d94f3-3.12.1","libsamba-hostconfig0":"4.13.13+git.545.5897c2d94f3-3.12.1","libsamba-passdb0":"4.13.13+git.545.5897c2d94f3-3.12.1","libsamdb0":"4.13.13+git.545.5897c2d94f3-3.12.1","libtevent-util0":"4.13.13+git.545.5897c2d94f3-3.12.1","samba-libs-python3":"4.13.13+git.545.5897c2d94f3-3.12.1","libdcerpc0":"4.13.13+git.545.5897c2d94f3-3.12.1","libndr-krb5pac0":"4.13.13+git.545.5897c2d94f3-3.12.1","libndr-standard0":"4.13.13+git.545.5897c2d94f3-3.12.1","libsamba-credentials0":"4.13.13+git.545.5897c2d94f3-3.12.1","libsamba-errors0":"4.13.13+git.545.5897c2d94f3-3.12.1","python3-ldb":"2.2.2-4.6.1","samba":"4.13.13+git.545.5897c2d94f3-3.12.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2022:0361-1.json"}},{"package":{"name":"samba","ecosystem":"SUSE:Enterprise Storage 7","purl":"pkg:rpm/suse/samba&distro=SUSE%20Enterprise%20Storage%207"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.13+git.545.5897c2d94f3-3.12.1"}]}],"ecosystem_specific":{"binaries":[{"libsamdb0":"4.13.13+git.545.5897c2d94f3-3.12.1","libsmbconf0":"4.13.13+git.545.5897c2d94f3-3.12.1","libtevent-util0":"4.13.13+git.545.5897c2d94f3-3.12.1","python3-ldb":"2.2.2-4.6.1","samba-ceph":"4.13.13+git.545.5897c2d94f3-3.12.1","libsamba-util0":"4.13.13+git.545.5897c2d94f3-3.12.1","libndr-nbt0":"4.13.13+git.545.5897c2d94f3-3.12.1","libnetapi0":"4.13.13+git.545.5897c2d94f3-3.12.1","libsmbclient0":"4.13.13+git.545.5897c2d94f3-3.12.1","libsmbldap2":"4.13.13+git.545.5897c2d94f3-3.12.1","samba-client":"4.13.13+git.545.5897c2d94f3-3.12.1","samba-libs-python3":"4.13.13+git.545.5897c2d94f3-3.12.1","samba-libs":"4.13.13+git.545.5897c2d94f3-3.12.1","ctdb":"4.13.13+git.545.5897c2d94f3-3.12.1","libndr-krb5pac0":"4.13.13+git.545.5897c2d94f3-3.12.1","libwbclient0":"4.13.13+git.545.5897c2d94f3-3.12.1","samba-winbind":"4.13.13+git.545.5897c2d94f3-3.12.1","samba":"4.13.13+git.545.5897c2d94f3-3.12.1","libsamba-errors0":"4.13.13+git.545.5897c2d94f3-3.12.1","libsamba-passdb0":"4.13.13+git.545.5897c2d94f3-3.12.1","libdcerpc-binding0":"4.13.13+git.545.5897c2d94f3-3.12.1","libdcerpc0":"4.13.13+git.545.5897c2d94f3-3.12.1","libldb2":"2.2.2-4.6.1","libndr-standard0":"4.13.13+git.545.5897c2d94f3-3.12.1","libndr1":"4.13.13+git.545.5897c2d94f3-3.12.1","libsamba-credentials0":"4.13.13+git.545.5897c2d94f3-3.12.1","libsamba-hostconfig0":"4.13.13+git.545.5897c2d94f3-3.12.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2022:0361-1.json"}}],"schema_version":"1.7.3"}