All of lore.kernel.org
 help / color / mirror / Atom feed
From: Peter Korsgaard <peter@korsgaard.com>
To: Bernd Kuhls <bernd@kuhls.net>
Cc: buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH 1/1] package/samba4: security bump version to 4.18.5
Date: Sat, 26 Aug 2023 19:41:00 +0200	[thread overview]
Message-ID: <874jkl8zwz.fsf@48ers.dk> (raw)
In-Reply-To: <20230719201005.1641739-1-bernd@kuhls.net> (Bernd Kuhls's message of "Wed, 19 Jul 2023 22:10:05 +0200")

>>>>> "Bernd" == Bernd Kuhls <bernd@kuhls.net> writes:

 > Release notes: https://www.samba.org/samba/history/samba-4.18.5.html
 > Fixes the following CVEs:

 > o CVE-2022-2127:
 > When winbind is used for NTLM authentication, a maliciously
 > crafted request can trigger an out-of-bounds read in winbind
 > and possibly crash it.
 > https://www.samba.org/samba/security/CVE-2022-2127.html

 > o CVE-2023-3347:
 > SMB2 packet signing is not enforced if an admin configured
 > "server signing = required" or for SMB2 connections to Domain
 > Controllers where SMB2 packet signing is mandatory.
 > https://www.samba.org/samba/security/CVE-2023-3347.html

 > o CVE-2023-34966:
 > An infinite loop bug in Samba's mdssvc RPC service for
 > Spotlight can be triggered by an unauthenticated attacker by
 > issuing a malformed RPC request.
 > https://www.samba.org/samba/security/CVE-2023-34966.html

 > o CVE-2023-34967:
 > Missing type validation in Samba's mdssvc RPC service for
 > Spotlight can be used by an unauthenticated attacker to
 > trigger a process crash in a shared RPC mdssvc worker process.
 > https://www.samba.org/samba/security/CVE-2023-34967.html

 > o CVE-2023-34968:
 > As part of the Spotlight protocol Samba discloses the server-
 > side absolute path of shares and files and directories in
 > search results.
 > https://www.samba.org/samba/security/CVE-2023-34968.html

 > Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Looks like the 4.15.x version is EOL, so applied to 2023.02.x and
2023.05.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

      parent reply	other threads:[~2023-08-26 17:41 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-07-19 20:10 [Buildroot] [PATCH 1/1] package/samba4: security bump version to 4.18.5 Bernd Kuhls
2023-07-20 21:29 ` Thomas Petazzoni via buildroot
2023-08-26 17:41 ` Peter Korsgaard [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=874jkl8zwz.fsf@48ers.dk \
    --to=peter@korsgaard.com \
    --cc=bernd@kuhls.net \
    --cc=buildroot@buildroot.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.