From patchwork Fri Aug 7 20:34:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10118 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hGx4x2R10z3wqC for ; Fri, 07 Aug 2026 20:46:09 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hGx4n0wnYz6n9 for ; Fri, 07 Aug 2026 20:46:01 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hGwt364dKz37kx for ; Fri, 07 Aug 2026 20:36:43 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hGwt12LJMz378m for ; Fri, 07 Aug 2026 20:36:41 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hGwss0m80z1k9; Fri, 07 Aug 2026 20:36:33 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1786134993; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=y/o+8sB0LcA0Et/xwQBoxF+kOByhhRrtJOmQRrAFLGo=; b=hA7MMPK5IM5Tzv61AS5MN+7VhRcCMdmd4c12qB8iyYFUoWCMTcCquTY8ZCkZ9teAPxNNd6 g0LZX5i3HC4xlhDA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1786134993; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=y/o+8sB0LcA0Et/xwQBoxF+kOByhhRrtJOmQRrAFLGo=; b=cJ9RGv6lKsuP99aZOGgZixToedQ6ujdPRyFoXlB4OTTWtC6STKOj1dyqq0WVKiqz/umIr0 xtrYFsYpfxOhxqtjR3VfH3icJrjmCD4fa6ZPpmc6JRVhylrs6uZgS4Ka8mMjpeOG4ob8zB 203uEO0RyWJrC3VavRWmxFgV0U3EUGZ5FehtFHt6yVLKj9fHgnunGETPQxdOz/0iNJccQQ TNkoxbvRt52vGwgayLoG22k2J3FV/FF4c5iNGsZriQDjZqGdQv2iZFGKvE1QQRwzKRJ9iv pXGGizY+ttqDLeArjFH/YJoj241HNYLNeKJLcqvwB7RXMnege4NLvf+FUCxILQ== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] samba: Update to version 4.24.5 Date: Fri, 7 Aug 2026 22:34:07 +0200 Message-ID: <20260807203410.1596981-18-adolf.belka@ipfire.org> In-Reply-To: <20260807203410.1596981-1-adolf.belka@ipfire.org> References: <20260807203410.1596981-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 4.24.2 to 4.24.5 - No change to the rootfiles - 6 CVE Fixes in 4.24.5 & 6 in 4.24.3 - Changelog 4.24.5 This is a security release in order to address the following defects: o CVE-2026-6949: TSIG packet with name compression can crash DNS Incorrect size calculations when a TSIG record contains compressed names can lead to a large out-of-bounds write causing the server to crash. https://www.samba.org/samba/security/CVE-2026-6949.html o CVE-2026-58216: An authenticated user could possibly crash a KDC process A kpasswd packet that contains malformed ASN.1 might cause the server to access 6 bytes of unallocated memory. This memory is not exposed to the user, but in some circumstances the server could crash. https://www.samba.org/samba/security/CVE-2026-58216.html o CVE-2026-58218: DNS signing DoS via TKEY name cache exhaustion An unauthenticated user can repeatedly register names TKEY names, which floods a cache causing legitimate TKEYs to be expunged. This can practically block the use DNS TSIG signing. https://www.samba.org/samba/security/CVE-2026-58218.html o CVE-2026-58221: Samba AD authenticated LDAP access domain takeover Samba AD low-privilege authenticated LDAP access allows modifications to internal LDB special DNs, which permits a domain takeover. https://www.samba.org/samba/security/CVE-2026-58221.html o CVE-2026-58222: Samba AD LDAP Compare filter injection and trusted-request confusion disclose protected attributes An ordinary authenticated domain user can bypass access checks and query confidential Active Directory attributes (such as KDS root keys) via LDAP Compare requests. Due to a filter injection flaw and trusted execution context, the LDAP Compare operation can be turned into a protected-attribute disclosure oracle. https://www.samba.org/samba/security/CVE-2026-58222.html o CVE-2026-58224 The CTDB protocol has bounds checking issues CTDB fails to do integrity checking of received packets. This includes failure to check field lengths against packet lengths when unmarshalling packets. https://www.samba.org/samba/security/CVE-2026-58224.html 4.24.4 * BUG 16095: Use-after-free in handling acls with claims and conditions * BUG 16092: Compilers may ignore overflow checks - Fix tautological-compare warnings * BUG 14638: restrict anonymous = 2 breaks RODC functionality * BUG 16006: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] * BUG 16067: Require NTLMv2 session security on Windows makes trusts to Samba unusable * BUG 16092: Compilers may ignore overflow checks - Fix tautological-compare warnings * BUG 16151: winbindd stuck in init_dc_connection_rpc() returning NT_STATUS_TRUSTED_DOMAIN_FAILURE * BUG 16006: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] * BUG 16149: domain\user not split when provided as username in smbc_set_credentials_with_fallback() 4.24.3 This is a security release in order to address the following defects: o CVE-2026-1933: Missing access checks on reparse point operations On a share marked "read only = yes" and on file handles opened R/O users can set or delete the reparse point xattrs on files that the user has write-access in the file system for. https://www.samba.org/samba/security/CVE-2026-1933.html o CVE-2026-2340: WORM vfs module does not block overwrites The WORM (Write-Once, Read Many) vfs module is supposed to lock write access to shared files, so they cannot be altered after initial writes. It was allowing files to be overwritten by renaming a newly created file over a protected file. https://www.samba.org/samba/security/CVE-2026-2340.html o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification To bootstrap a certificate chain a domain member must fetch a certificate without TLS. It was trusting HTTP for this when a more secure encrypted LDAP channel was also available. https://www.samba.org/samba/security/CVE-2026-3012.html o CVE-2026-3238: Denial of service against AD DC WINS server The WINS server component of the Active Directory Domain controller code in Samba is vulnerable to a NULL pointer dereference and crash caused by a unauthenticated UDP packet. https://www.samba.org/samba/security/CVE-2026-3238.html o CVE-2026-4408: Unauthenticated Remote Code Execution in Samba DCE/RPC SAMR server Samba file servers and classic (non-AD) domain controllers with samba-dcerpcd started as a system service and with a "check password script" that has the %u substitution character are vulnerable to a remote code execution. https://www.samba.org/samba/security/CVE-2026-4408.html o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing subsystem Samba print servers with a "print command" that has the %J substitution character are vulnerable to a Remote Code Execution. https://www.samba.org/samba/security/CVE-2026-4480.html Signed-off-by: Adolf Belka --- lfs/samba | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/samba b/lfs/samba index 545faac50..c21e8bbc0 100644 --- a/lfs/samba +++ b/lfs/samba @@ -24,7 +24,7 @@ include Config -VER = 4.24.2 +VER = 4.24.5 SUMMARY = A SMB/CIFS File, Print, and Authentication Server THISAPP = samba-$(VER) @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = samba -PAK_VER = 122 +PAK_VER = 123 DEPS = avahi libtalloc perl-Parse-Yapp wsdd @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 464b9324b1c4d9e50d70c0d921c65b775f49db9e9b82314cc072ad03087f2d2f3ca4c9cf2925a3628c07c2f4664f58f9a36528078a14666d1fcb20ddb7949b44 +$(DL_FILE)_BLAKE2 = 4796e3ae5e70c1d11d9326566677f0909423c5aad140309bfd9b3f8a3dedefe49660d0a0d502a681726ed7a961779587c33c9da29ecf69664b00a2ca958e64af install : $(TARGET)