<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "Menlo"), DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: 0.875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px;
}
body {
font-family: var(--default-regular-font, -apple-system),BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px; font-family: var(--default-regular-font, -apple-system),BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<h3 style="margin-top: 20px; margin-bottom: 10px;">
Michael Tokarev pushed to branch bookworm at <a href="https://salsa.debian.org/samba-team/samba">Debian Samba Team / samba</a>
</h3>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
Commits:
</h4>
<ul>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/d48c42c7d26637b19f6eb7e020a2e90b56b07e6b">d48c42c7</a></strong>
<div>
<span> by Jule Anger </span> <i> at 2023-07-06T15:41:31+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>VERSION: Bump version up to Samba 4.17.10...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Jule Anger <janger@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/a3944de6990686bf674e7a9badded501873a7cfa">a3944de6</a></strong>
<div>
<span> by Volker Lendecke </span> <i> at 2023-07-14T15:14:46+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2022-2127: winbindd: Fix WINBINDD_PAM_AUTH_CRAP length checks
With WBFLAG_BIG_NTLMV2_BLOB being set plus lm_resp_len too large you
can crash winbind. We don't independently check lm_resp_len
sufficiently.
Discovered via Coverity ID 1504444 Out-of-bounds access
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15072
Signed-off-by: Volker Lendecke <vl@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/53838682570135b753fa622dfcde111528563c2d">53838682</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:14:46+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2022-2127: ntlm_auth: cap lanman response length value
We already copy at most sizeof(request.data.auth_crap.lm_resp) bytes to the
lm_resp buffer, but we don't cap the length indicator.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15072
Signed-off-by: Ralph Boehme <slow@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/6e5e5c7f64eef80e10473e860a1662ce66491e8e">6e5e5c7f</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:14:54+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34966: CI: test for sl_unpack_loop()
Send a maliciously crafted packet where a nil type has a subcount of 0. This
triggers an endless loop in mdssvc sl_unpack_loop().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15340
Signed-off-by: Ralph Boehme <slow@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/c77b31f1bcb8778007cfa584e15f3bb2f7135752">c77b31f1</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:14:54+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34966: mdssvc: harden sl_unpack_loop()
A malicious client could send a packet where subcount is zero, leading to a busy
loop because
count -= subcount
=> count -= 0
=> while (count > 0)
loops forever.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15340
Signed-off-by: Ralph Boehme <slow@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/7812c56d4cb44a59a49c68d05a9c38c1d2ebeb19">7812c56d</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:14:57+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34967: CI: add a test for type checking of dalloc_value_for_key()
Sends a maliciously crafted packet where the value in a key/value style
dictionary for the "scope" key is a simple string object whereas the server
expects an array. As the server doesn't perform type validation on the value, it
crashes when trying to use the "simple" object as a "complex" one.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15341
Signed-off-by: Ralph Boehme <slow@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/049c13245649fab412b61a5b55e5a7dea72d7c72">049c1324</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:14:57+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34967: mdssvc: add type checking to dalloc_value_for_key()
Change the dalloc_value_for_key() function to require an additional final
argument which denotes the expected type of the value associated with a key. If
the types don't match, return NULL.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15341
Signed-off-by: Ralph Boehme <slow@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/98b2a013bc723cd660978d5a1db40b987816f90e">98b2a013</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:00+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34968: mdssvc: cache and reuse stat info in struct sl_inode_path_map
Prepare for the "path" being a fake path and not the real server-side
path where we won't be able to vfs_stat_fsp() this fake path. Luckily we already
got stat info for the object in mds_add_result() so we can just pass stat info
from there.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15388
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/47a0c1681dd1e7ec407679793966ec8bdc08a24e">47a0c168</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:00+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34968: mdssvc: add missing "kMDSStoreMetaScopes" dict key in slrpc_fetch_properties()
We were adding the value, but not the key.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15388
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/56a21b3bc8fb24416ead9061f9305c8122bc7f86">56a21b3b</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:00+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34968: mdscli: use correct TALLOC memory context when allocating spotlight_blob
d is talloc_free()d at the end of the functions and the buffer was later used
after beeing freed in the DCERPC layer when sending the packet.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15388
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/0ae6084d1a9c4eb12e9f1ab1902e00f96bcbea55">0ae6084d</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:00+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34968: mdscli: remove response blob allocation
This is handled by the NDR code transparently.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15388
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/353a9ccea6ff93ea2cd604dcc2b0372f056f819d">353a9cce</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:00+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34968: smbtorture: remove response blob allocation in mdssvc.c
This is alreay done by NDR for us.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15388
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/449f1280b718c6da3b8e309fe124be4e9bfd8184">449f1280</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:00+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34968: rpcclient: remove response blob allocation
This is alreay done by NDR for us.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15388
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/cc593a6ac531f02f2fe70fd4f7dfe649a02f9206">cc593a6a</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:00+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34968: mdssvc: remove response blob allocation
This is alreay done by NDR for us.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15388
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/ee428be9c67b1a7c9720c98f4aa67208e1b2938b">ee428be9</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:01+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34968: mdssvc: switch to doing an early return
Just reduce indentation of the code handling the success case. No change in
behaviour.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15388
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/cb8313e7bee75454ce29d2b2f657927259298f52">cb8313e7</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:01+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34968: mdssvc: introduce an allocating wrapper to sl_pack()
sl_pack_alloc() does the buffer allocation that previously all callers of
sl_pack() did themselves.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15388
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/a5c570e262911874e43e82de601d809aa5b1b729">a5c570e2</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:01+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34968: mdscli: return share relative paths
The next commit will change the Samba Spotlight server to return absolute paths
that start with the sharename as "/SHARENAME/..." followed by the share path
relative appended.
So given a share
[spotlight]
path = /foo/bar
spotlight = yes
and a file inside this share with a full path of
/foo/bar/dir/file
previously a search that matched this file would returns the absolute
server-side pato of the file, ie
/foo/bar/dir/file
This will be change to
/spotlight/dir/file
As currently the mdscli library and hence the mdsearch tool print out these
paths returned from the server, we have to change the output to accomodate these
fake paths. The only way to do this sensibly is by makeing the paths relative to
the containing share, so just
dir/file
in the example above.
The client learns about the share root path prefix – real server-side of fake in
the future – in an initial handshake in the "share_path" out argument of the
mdssvc_open() RPC call, so the client can use this path to convert the absolute
path to relative.
There is however an additional twist: the macOS Spotlight server prefixes this
absolute path with another prefix, typically "/System/Volumes/Data", so in the
example above the full path for the same search would be
/System/Volumes/Data/foo/bar/dir/file
So macOS does return the full server-side path too, just prefixed with an
additional path. This path prefixed can be queried by the client in the
mdssvc_cmd() RPC call with an Spotlight command of "fetchPropertiesForContext:"
and the path is returned in a dictionary with key "kMDSStorePathScopes". Samba
just returns "/" for this.
Currently the mdscli library doesn't issue this Spotlight RPC
request (fetchPropertiesForContext), so this is added in this commit. In the
end, all search result paths are stripped of the combined prefix
kMDSStorePathScopes + share_path (from mdssvc_open).
eg
kMDSStorePathScopes = /System/Volumes/Data
share_path = /foo/bar
search result = /System/Volumes/Data/foo/bar/dir/file
relative path returned by mdscli = dir/file
Makes sense? :)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15388
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/091b0265fe42878d676def5d4f5b4f8f3977b0e2">091b0265</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:01+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-34968: mdssvc: return a fake share path
Instead of returning the real server-side absolute path of shares and search
results, return a fake absolute path replacing the path of the share with the
share name, iow for a share "test" with a server-side path of "/foo/bar", we
previously returned
/foo/bar and
/foo/bar/search/result
and now return
/test and
/test/search/result
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15388
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/e67b7e5f88ea29670009eef6a69e3f60ebed3517">e67b7e5f</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:04+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-3347: CI: add a test for server-side mandatory signing
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15397
Signed-off-by: Ralph Boehme <slow@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/e96d5002fc10b3e74c7ed90f8cf7cf234a06a3d1">e96d5002</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:04+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-3347: smbd: pass lp_ctx to smb[1|2]_srv_init_signing()
No change in behaviour.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15397
Signed-off-by: Ralph Boehme <slow@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/95cec0dfa2410e667551a1faaef08c8cd2a80074">95cec0df</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:04+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-3347: smbd: inline smb2_srv_init_signing() code in srv_init_signing()
It's now a one-line function, imho the overall code is simpler if that code is
just inlined.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15397
Signed-off-by: Ralph Boehme <slow@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/a22fcb689187a7b1fa20d008026c91283e222390">a22fcb68</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:04+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-3347: smbd: remove comment in smbd_smb2_request_process_negprot()
This is just going to bitrot. Anyone who's interested can just grep for
"signing_mandatory" and look up what it does.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15397
Signed-off-by: Ralph Boehme <slow@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/6c1128b11842d60e3ebd9ee1b5cefcfd99629ba5">6c1128b1</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2023-07-14T15:15:04+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2023-3347: smbd: fix "server signing = mandatory"
This was broken by commit 1f3f6e20dc086a36de52bffd0bc36e15fb19e1c6 because when
calling srv_init_signing() very early after accepting the connection in
smbd_add_connection(), conn->protocol is still PROTOCOL_NONE.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15397
Signed-off-by: Ralph Boehme <slow@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/492a52b1c4c97667d711efe1410aace18e940cf0">492a52b1</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2023-07-17T10:28:30+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>netlogon.idl: add support for netr_LogonGetCapabilities response level 2
We don't have any documentation about this yet, but tests against
a Windows Server 2022 patched with KB5028166 revealed that
the response for query_level=2 is exactly the same as
for querey_level=1.
Until we know the reason for query_level=2 we won't
use it as client nor support it in the server, but
we want ndrdump to work.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 5f87888ed53320538cf773d64868390d8641a40e)
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/e14a5c36123ac01c91851cb40483e6251d9d43e9">e14a5c36</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2023-07-17T10:28:30+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s4:torture/rpc: let rpc.schannel also check netr_LogonGetCapabilities with different levels
The important change it that we expect DCERPC_NCA_S_FAULT_INVALID_TAG
for unsupported query_levels, we allow it to work with servers
with or without support for query_level=2.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 404ce08e9088968311c714e756f5d58ce2cef715)
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/55d0a38601236b89871f1a2f2bf7ad36c590f1f4">55d0a386</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2023-07-17T10:28:30+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s4:rpc_server:netlogon: generate FAULT_INVALID_TAG for invalid netr_LogonGetCapabilities levels
This is important as Windows clients with KB5028166 seem to
call netr_LogonGetCapabilities with query_level=2 after
a call with query_level=1.
An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG
for query_level values other than 1.
While Samba tries to return NT_STATUS_NOT_SUPPORTED, but
later fails to marshall the response, which results
in DCERPC_FAULT_BAD_STUB_DATA instead.
Because we don't have any documentation for level 2 yet,
we just try to behave like an unpatched server and
generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of
DCERPC_FAULT_BAD_STUB_DATA.
Which allows patched Windows clients to keep working
against a Samba DC.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit d5f1097b6220676d56ed5fc6707acf667b704518)
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/56fad90eaef07d11665c35ffc872f34165496076">56fad90e</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2023-07-17T10:28:30+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s3:rpc_server:netlogon: generate FAULT_INVALID_TAG for invalid netr_LogonGetCapabilities levels
This is important as Windows clients with KB5028166 seem to
call netr_LogonGetCapabilities with query_level=2 after
a call with query_level=1.
An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG
for query_level values other than 1.
While Samba tries to return NT_STATUS_NOT_SUPPORTED, but
later fails to marshall the response, which results
in DCERPC_FAULT_BAD_STUB_DATA instead.
Because we don't have any documentation for level 2 yet,
we just try to behave like an unpatched server and
generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of
DCERPC_FAULT_BAD_STUB_DATA.
Which allows patched Windows clients to keep working
against a Samba DC.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Mon Jul 17 07:35:09 UTC 2023 on atb-devel-224
(cherry picked from commit dfeabce44fbb78083fbbb2aa634fc4172cf83db9)
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/1448e347b2f6c29b484b8c66ce5469c0e11d81f9">1448e347</a></strong>
<div>
<span> by Jule Anger </span> <i> at 2023-07-17T22:19:16+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>WHATSNEW: Add release notes for Samba 4.17.10.
Signed-off-by: Jule Anger <janger@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/5eceb0dfb4a6490da3e7fc58f4b527b16b934195">5eceb0df</a></strong>
<div>
<span> by Jule Anger </span> <i> at 2023-07-17T22:19:16+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>VERSION: Disable GIT_SNAPSHOT for the 4.17.10 release.
Signed-off-by: Jule Anger <janger@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/c6a6a72b7d9fe37ea11204ef064d46168bbe02fa">c6a6a72b</a></strong>
<div>
<span> by Michael Tokarev </span> <i> at 2023-07-19T17:59:33+03:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 4.17.10+dfsg</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/f3a1e02c3ad8f0a657c6e9a5f3204f8942471483">f3a1e02c</a></strong>
<div>
<span> by Michael Tokarev </span> <i> at 2023-07-19T18:00:44+03:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Update upstream source from tag 'upstream/4.17.10+dfsg'
Update to upstream version '4.17.10+dfsg'
with Debian dir 87b52a2bb0da173cef9cf7687a9b07b0a90649b7</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/842fb86a36129bf268b79b8ef25226b531a871b7">842fb86a</a></strong>
<div>
<span> by Michael Tokarev </span> <i> at 2023-07-19T18:01:10+03:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>remove fix-unsupported-netr_LogonGetCapabilities-l2.patch (fix is included now)
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/ff0a13b20bbf5daa61e1d0c51db2fc3f65bf84f0">ff0a13b2</a></strong>
<div>
<span> by Michael Tokarev </span> <i> at 2023-07-19T18:15:37+03:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.875rem; color: #333238; position: relative; font-family: var(--default-mono-font, "Menlo"),"DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>update changelog; upload version 4.17.10+dfsg-0+deb12u1 to bookworm-security
</pre>
</li>
</ul>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
30 changed files:
</h4>
<ul>
<li class="file-stats">
<a href="#b33892fbddeffc3368077b4904ad0b3d562a7312">
VERSION
</a>
</li>
<li class="file-stats">
<a href="#3277e12b5a9f9ff632d229e2629d34ad21dd93fc">
WHATSNEW.txt
</a>
</li>
<li class="file-stats">
<a href="#9c96da0e9f91d7d8937b69b524702c106258f0d1">
debian/changelog
</a>
</li>
<li class="file-stats">
<a href="#e485fd1a494a5a919dfa9681fce2ad65dc08f711">
<span class="deleted-file">
−
debian/patches/fix-unsupported-netr_LogonGetCapabilities-l2.patch
</span>
</a>
</li>
<li class="file-stats">
<a href="#bc34014ab4b9a49dd7a27bdd8d352912607c3a96">
debian/patches/series
</a>
</li>
<li class="file-stats">
<a href="#451d095971823f64d1f8d219b32b4996402879b0">
librpc/idl/netlogon.idl
</a>
</li>
<li class="file-stats">
<a href="#0b32754d74577a1a026d6d327a224782a12de739">
python/samba/tests/blackbox/mdsearch.py
</a>
</li>
<li class="file-stats">
<a href="#2922e955b5f7dfb6c4c7adaa3e7535817b1c9b23">
python/samba/tests/dcerpc/mdssvc.py
</a>
</li>
<li class="file-stats">
<a href="#527e1033d396107d2be275d0ed231501759e6241">
selftest/target/Samba3.pm
</a>
</li>
<li class="file-stats">
<a href="#c6b4b66a76c321e5886d6da7e74d56378a80a701">
source3/rpc_client/cli_mdssvc.c
</a>
</li>
<li class="file-stats">
<a href="#d75fab8cbe807e7a407522f1f2aac45ba2626a09">
source3/rpc_client/cli_mdssvc_private.h
</a>
</li>
<li class="file-stats">
<a href="#485c68f9516bb6a05b4aede6682bb8a730a50739">
source3/rpc_client/cli_mdssvc_util.c
</a>
</li>
<li class="file-stats">
<a href="#ed2885bdef4d91a7b54f0e1eb5b05f79ed16d4de">
source3/rpc_client/cli_mdssvc_util.h
</a>
</li>
<li class="file-stats">
<a href="#c3b0032879d6cf5831e9bb183b94fbe909e195b4">
source3/rpc_server/mdssvc/dalloc.c
</a>
</li>
<li class="file-stats">
<a href="#c8853a90e9604404924e7a3ab14693d77a9cbd02">
source3/rpc_server/mdssvc/marshalling.c
</a>
</li>
<li class="file-stats">
<a href="#bc9bfae0d6c5c75d82c5750309e66c814f2476b1">
source3/rpc_server/mdssvc/marshalling.h
</a>
</li>
<li class="file-stats">
<a href="#e319380e55f54d3ae7b154229c0640a08c1afd4f">
source3/rpc_server/mdssvc/mdssvc.c
</a>
</li>
<li class="file-stats">
<a href="#1c4031cd685c23ab3927dd6605930145f28416e2">
source3/rpc_server/mdssvc/mdssvc.h
</a>
</li>
<li class="file-stats">
<a href="#1214d47ed31ac2d3ce0a7feb99a1fb4eb5919095">
source3/rpc_server/mdssvc/srv_mdssvc_nt.c
</a>
</li>
<li class="file-stats">
<a href="#31a95f1d16e27cfe47e79e36311eef6b63713b7c">
source3/rpc_server/netlogon/srv_netlog_nt.c
</a>
</li>
<li class="file-stats">
<a href="#143118205ff98124d708668c04073aec3930ae9e">
source3/rpcclient/cmd_spotlight.c
</a>
</li>
<li class="file-stats">
<a href="#75bc75497231bbcc74880ae0917386d44729c127">
source3/selftest/tests.py
</a>
</li>
<li class="file-stats">
<a href="#55e6453a63e8698fe48a77fdb0131758f36e9e9c">
source3/smbd/proto.h
</a>
</li>
<li class="file-stats">
<a href="#6ad101a21925642b02e7ee3706aebe128158b9ed">
source3/smbd/smb1_signing.c
</a>
</li>
<li class="file-stats">
<a href="#e8c5590dc34da4ef1bc84a3d30e980e7f67e9c3c">
source3/smbd/smb1_signing.h
</a>
</li>
<li class="file-stats">
<a href="#2844f5e1be3d603be48df02c2a0b5704aab0328e">
source3/smbd/smb2_negprot.c
</a>
</li>
<li class="file-stats">
<a href="#91390b7c499ad79ab21df728a7b8f950eae21958">
source3/smbd/smb2_signing.c
</a>
</li>
<li class="file-stats">
<a href="#aa6865e121e1ea771f242d1eda15368fc449b181">
source3/utils/ntlm_auth.c
</a>
</li>
<li class="file-stats">
<a href="#5c88eddc60af488bf405f5b71ec2ea853085b36d">
source3/winbindd/winbindd_pam_auth_crap.c
</a>
</li>
<li class="file-stats">
<a href="#ab87be9dbeec12af2a9b3bf2cc5de4527e01a948">
source4/rpc_server/netlogon/dcerpc_netlogon.c
</a>
</li>
</ul>
<h5 style="margin-top: 10px; margin-bottom: 10px; font-size: 0.875rem;">
The diff was not included because it is too large.
</h5>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #737278;">
—
<br>
<a href="https://salsa.debian.org/samba-team/samba/-/compare/dec07df126e2163d7d9c85f9ad7dcc23b4e6d0ae...ff0a13b20bbf5daa61e1d0c51db2fc3f65bf84f0">View it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://salsa.debian.org">salsa.debian.org</a>. <a href="https://salsa.debian.org/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://salsa.debian.org/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
</p>
</div>
</body>
</html>