[Buildroot] [PATCH 1/1] package/samba4: security bump version to 4.24.5

[Bernd Kuhls <bernd@kuhls.net>]

https://www.samba.org/samba/history/samba-4.24.5.html

This is a security release in order to address the following defects:

o CVE-2026-6949:
  TSIG packet with name compression can crash DNS

   Incorrect size calculations when a TSIG record contains
   compressed names can lead to a large out-of-bounds write
   causing the server to crash.

   https://www.samba.org/samba/security/CVE-2026-6949.html

o CVE-2026-58216:
  An authenticated user could possibly crash a KDC process

   A kpasswd packet that contains malformed ASN.1 might cause
   the server to access 6 bytes of unallocated memory. This
   memory is not exposed to the user, but in some
   circumstances the server could crash.

   https://www.samba.org/samba/security/CVE-2026-58216.html

o CVE-2026-58218:
  DNS signing DoS via TKEY name cache exhaustion

   An unauthenticated user can repeatedly register names TKEY
   names, which floods a cache causing legitimate TKEYs to be
   expunged. This can practically block the use DNS TSIG
   signing.

   https://www.samba.org/samba/security/CVE-2026-58218.html

o CVE-2026-58221:
  Samba AD authenticated LDAP access domain takeover

   Samba AD low-privilege authenticated LDAP access allows
   modifications to internal LDB special DNs, which permits a
   domain takeover.

   https://www.samba.org/samba/security/CVE-2026-58221.html

o CVE-2026-58222:
  Samba AD LDAP Compare filter injection and trusted-request
   confusion disclose protected attributes

   An ordinary authenticated domain user can bypass access
   checks and query confidential Active Directory attributes
   (such as KDS root keys) via LDAP Compare requests. Due to a
   filter injection flaw and trusted execution context, the
   LDAP Compare operation can be turned into a
   protected-attribute disclosure oracle.

   https://www.samba.org/samba/security/CVE-2026-58222.html

o CVE-2026-58224:
  The CTDB protocol has bounds checking issues

   CTDB fails to do integrity checking of received packets.
   This includes failure to check field lengths against packet
   lengths when unmarshalling packets.

   https://www.samba.org/samba/security/CVE-2026-58224.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
Gitlab pipelines passed:
https://gitlab.com/bkuhls/buildroot/-/commits/dd2f625c6688cf48bdde48380fe744e2fdec5551

 package/samba4/samba4.hash | 4 ++--
 package/samba4/samba4.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/samba4/samba4.hash b/package/samba4/samba4.hash
index 7c44ed747a..3931e55669 100644
--- a/package/samba4/samba4.hash
+++ b/package/samba4/samba4.hash
@@ -1,4 +1,4 @@
 # Locally calculated after checking pgp signature
-# https://download.samba.org/pub/samba/stable/samba-4.24.4.tar.asc
-sha256  df2c51ab4361ec626ab9988e5946efcca8465bc7afae834291d5558468265ff8  samba-4.24.4.tar.gz
+# https://download.samba.org/pub/samba/stable/samba-4.24.5.tar.asc
+sha256  6d5d7ee82f5ce9da4135086c9b184e47a58b4b023565f58abbb1f8c8a922306b  samba-4.24.5.tar.gz
 sha256  8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903  COPYING
diff --git a/package/samba4/samba4.mk b/package/samba4/samba4.mk
index d481f9d417..79551e1ee4 100644
--- a/package/samba4/samba4.mk
+++ b/package/samba4/samba4.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-SAMBA4_VERSION = 4.24.4
+SAMBA4_VERSION = 4.24.5
 SAMBA4_SITE = https://download.samba.org/pub/samba/stable
 SAMBA4_SOURCE = samba-$(SAMBA4_VERSION).tar.gz
 SAMBA4_INSTALL_STAGING = YES
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot