[Pkg-samba-maint] Bug#987811: samba: CVE-2021-20254

[Salvatore Bonaccorso]

Source: samba
Version: 2:4.13.5+dfsg-1
Severity: grave
Tags: security upstream
Justification: user security hole
Forwarded: https://bugzilla.samba.org/show_bug.cgi?id=14571
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: found -1 2:4.9.5+dfsg-5

Hi,

The following vulnerability was published for samba.

I think would be best if we can have this fixed in bullseye, though
note we marked it for now no-dsa for buster itself.

CVE-2021-20254[0]:
| Negative idmap cache entries can cause incorrect group entries in
| the Samba file server process token

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-20254
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20254
[1] https://bugzilla.samba.org/show_bug.cgi?id=14571
[2] https://www.samba.org/samba/security/CVE-2021-20254.html
[3] https://git.samba.org/?p=samba.git;a=commitdiff;h=75ad84167f5d2379557ec078d17c9a1c244402fc

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore