Re: [Buildroot] [PATCH 1/1] package/samba4: security bump version to 4.18.5

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Bernd" == Bernd Kuhls <bernd@kuhls.net> writes:

 > Release notes: https://www.samba.org/samba/history/samba-4.18.5.html
 > Fixes the following CVEs:

 > o CVE-2022-2127:
 > When winbind is used for NTLM authentication, a maliciously
 > crafted request can trigger an out-of-bounds read in winbind
 > and possibly crash it.
 > https://www.samba.org/samba/security/CVE-2022-2127.html

 > o CVE-2023-3347:
 > SMB2 packet signing is not enforced if an admin configured
 > "server signing = required" or for SMB2 connections to Domain
 > Controllers where SMB2 packet signing is mandatory.
 > https://www.samba.org/samba/security/CVE-2023-3347.html

 > o CVE-2023-34966:
 > An infinite loop bug in Samba's mdssvc RPC service for
 > Spotlight can be triggered by an unauthenticated attacker by
 > issuing a malformed RPC request.
 > https://www.samba.org/samba/security/CVE-2023-34966.html

 > o CVE-2023-34967:
 > Missing type validation in Samba's mdssvc RPC service for
 > Spotlight can be used by an unauthenticated attacker to
 > trigger a process crash in a shared RPC mdssvc worker process.
 > https://www.samba.org/samba/security/CVE-2023-34967.html

 > o CVE-2023-34968:
 > As part of the Spotlight protocol Samba discloses the server-
 > side absolute path of shares and files and directories in
 > search results.
 > https://www.samba.org/samba/security/CVE-2023-34968.html

 > Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Looks like the 4.15.x version is EOL, so applied to 2023.02.x and
2023.05.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot