[Pkg-samba-maint] [Git][samba-team/samba][debian/4.23] 121 commits: VERSION: Bump version up to Samba 4.23.9...
Michael Tokarev (@mjt)
gitlab at salsa.debian.org
Mon Aug 3 22:53:31 BST 2026
Michael Tokarev pushed to branch debian/4.23 at Debian Samba Team / samba
Commits:
3e9dfe04 by Stefan Metzmacher at 2026-05-26T14:46:59+02:00
VERSION: Bump version up to Samba 4.23.9...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Stefan Metzmacher <metze at samba.org>
- - - - -
7827b04a by Stefan Metzmacher at 2026-05-28T00:37:12+00:00
s3:smb2_server: failing lease/oplock breaks should call smbd_server_connection_terminate()
If there's a problem sending a lease break we need to
call smbd_server_connection_terminate(xconn).
Currently we only called smbXsrv_connection_disconnect_transport(),
which only closes the low level socket, but it doesn't
cleanup smbXsrv_connection and in case of the last connection
for the smbXsrv_client, so we leave the stale structures and
the stale process behind.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15995
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
(cherry picked from commit 734481e2aa9c9bb20fc9bc8734eba85d2f61be72)
- - - - -
c0607a2f by Stefan Metzmacher at 2026-05-28T00:37:12+00:00
s3:winbindd: let init_dc_connection_rpc() fail if domain->dcname is still NULL
This can happen on a DC itself trying to talk to itself,
which is currently not expected.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15973
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 38a9910ac99a015a3dac76b93f02d16e140c05e6)
- - - - -
34c6989c by Stefan Metzmacher at 2026-05-28T00:37:12+00:00
s3:winbindd: replace smbXcli_conn_remote_{name,sockaddr}() with domain->{dcname,dcaddr}
domain->conn.cli might be NULL, so we should not deference it.
init_dc_connection_rpc() already checks that domain->dcname is not
NULL...
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15973
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 34c4ab4c610960ba587659e077608778970363a0)
- - - - -
38a25047 by Stefan Metzmacher at 2026-05-28T00:37:12+00:00
s3:winbindd: let wb_irpc_SamLogon reject the local domain as RWDC
If the clients use a subdomain of our domain the
'sam' auth backend passed the request along to
the 'winbind' auth backend. If winbindd tries
to use the local domain we hit the case that
an unknown domain was used. So we need to
bounce the request back to 'sam_ignoredomain'.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15973
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Autobuild-User(master): Volker Lendecke <vl at samba.org>
Autobuild-Date(master): Tue Apr 28 11:49:16 UTC 2026 on atb-devel-224
(cherry picked from commit b4e612725f9fe11f1791bd170cef8b0dade45ba6)
- - - - -
9d60172b by Shachar Sharon at 2026-05-28T00:37:12+00:00
ctdb-server: Fix use-after-free bug
When 'rev_hdl->fde' is NULL due to failure in tevent_add_fd bail-out
with free-and-error in order to avoid pointer dereferencing 'rev_hdl'
after it is freed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16068
Signed-off-by: Shachar Sharon <ssharon at redhat.com>
Reviewed-by: Martin Schwenke <martin at meltin.net>
Reviewed-by: Anoop C S <anoopcs at samba.org>
Reviewed-by: Vinit Agnihotri <vagnihot at redhat.com>
Reviewed-by: Avan Thakkar <athakkar at redhat.com>
(cherry picked from commit 88e09693a434d06ab57b14c1c1afe5996422ca0a)
- - - - -
118fd1b4 by Shachar Sharon at 2026-05-28T00:37:12+00:00
ctdb-server: Cleanup child resources via local helper
Define 'revokechild_finish' as resource cleanup helper. Call it either
via destructor (normal case) or upon allocation failure.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16068
Signed-off-by: Shachar Sharon <ssharon at redhat.com>
Reviewed-by: Martin Schwenke <martin at meltin.net>
Reviewed-by: Anoop C S <anoopcs at samba.org>
Reviewed-by: Vinit Agnihotri <vagnihot at redhat.com>
Reviewed-by: Avan Thakkar <athakkar at redhat.com>
Autobuild-User(master): Martin Schwenke <martins at samba.org>
Autobuild-Date(master): Wed May 6 05:28:48 UTC 2026 on atb-devel-224
(cherry picked from commit 67f139ad28c6a771bac488b09d52dda81f3ffe81)
- - - - -
c6d1b346 by Ralph Boehme at 2026-05-28T00:37:12+00:00
smbtorture: rename test smb2.maximum_allowed.read_only to smb2.maximum_allowed.read_only_file
Soon going to add another test for directories called smb2.maximum_allowed.read_only_dir.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16030
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit 605542e58fb3c436d4a5c0aa5b6b430d135ac7ff)
- - - - -
9b85ed99 by Ralph Boehme at 2026-05-28T00:37:12+00:00
smbtorture: add additional checks to smb2.maximum_allowed.read_only_file
Prooves that:
- the "MxAC" context response actually ignores FILE_ATTRIBUTE_READONLY,
- actuall effective access rights honor FILE_ATTRIBUTE_READONLY (using
RAW_FILEINFO_ACCESS_INFORMATION getinfo level),
- attempting to write to a file with FILE_ATTRIBUTE_READONLY fails.
Test passed against Windows, fails against both s3 and s4 servers. Skipping the
ad_dc_ntvfs test in the future, I'm not going to fix that.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16030
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit 878e7975de17b5c8218cb2c44b44d8a8fac4f073)
- - - - -
7efa3b5e by Ralph Boehme at 2026-05-28T00:37:12+00:00
smbtorture: add test smb2.maximum_allowed.read_only_dir
Verifies that FILE_ATTRIBUTE_READONLY is effectively ignored on directories.
Passes against Windows, fails against Samba: Samba enforces read-only access in
fsp->access_mask and "MxAC" create context response for directories with
FILE_ATTRIBUTE_READONLY. This is wrong, Windows doesn't do this.
Note that MS-FSA doesn't quite has all these details right, the correct
behaviour was taken from a modern Windows server.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16030
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit b6d53b25e2788473e3cec483bc6a4220cc9641c1)
- - - - -
7458731a by Ralph Boehme at 2026-05-28T00:37:12+00:00
smbd: split read-only checks in smbd_calculate_maximum_allowed_access_fsp()
Prepares for adjusting the permission when the FILE_ATTRIBUTE_READONLY is set in
the next commmit.
No change in behaviour.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16030
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit 671c7bb4dc9c7142b7eeaa673b6cc692b5b67425)
- - - - -
e7a8c0e4 by Ralph Boehme at 2026-05-28T00:37:12+00:00
smbd: ignore FILE_ATTRIBUTE_READONLY for the "MxAC" create context
As much as I dislike adding a boolean parameter to control this behaviour, I
don't see a different clean way to do it.
Note that I'm not touching the case where the share is realy-only, I just don't
want to open that additional can of worms now and instead focus on fixing the
FILE_ATTRIBUTE_READONLY case.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16030
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit 03fa9d035d0bd657eaf46abfd8bedf93681a4338)
- - - - -
3d74e101 by Ralph Boehme at 2026-05-28T00:37:12+00:00
smbd: apply read-only attribute access restrictions only to files
Also mask off the exact access rights given in MS_FSA 2.1.5.1.2.1 "Algorithm to
Check Access to an Existing File".
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16030
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit 2a1b8321af1755fa424eec8c3931f167a8399127)
- - - - -
3c4c0cff by Ralph Boehme at 2026-05-28T00:37:12+00:00
smbd: do S_ISDIR check even earlier
Doing this in open_file() is too late, as when the client requests an open with
SEC_FLAG_MAXIMUM_ALLOWED on a directory that has FILE_ATTRIBUTE_READ_ONLY set,
this will currently trigger an NT_STATUS_ACCESS_DENIED by the following code in
open_file_ntcreate() if the ACL grants write access to the user:
if (((flags & O_ACCMODE) != O_RDONLY) && file_existed &&
(!CAN_WRITE(conn) ||
(existing_dos_attributes & FILE_ATTRIBUTE_READONLY))) {
DEBUG(5,("open_file_ntcreate: write access requested for "
"file %s on read only %s\n",
smb_fname_str_dbg(smb_fname),
!CAN_WRITE(conn) ? "share" : "file" ));
return NT_STATUS_ACCESS_DENIED;
}
Fixes this bug, but should otherwise cause no change in behaviour.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16030
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
Autobuild-Date(master): Wed Apr 29 12:00:18 UTC 2026 on atb-devel-224
(cherry picked from commit 4ab12a63a4aa4f3625bc3e81817d0169c9b2766e)
- - - - -
556c7927 by Björn Jacke at 2026-05-28T00:37:12+00:00
samba-tool: fix documentation for timestamp format specifiers
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16076
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
Reviewed-by: Björn Baumbach <bb at sernet.de>
Autobuild-User(master): Björn Jacke <bjacke at samba.org>
Autobuild-Date(master): Tue May 12 11:19:12 UTC 2026 on atb-devel-224
(cherry picked from commit 66fec3d4ff0981456e8548ef8497a5137bbfa755)
- - - - -
f33863d3 by Andreas Schneider at 2026-05-28T01:37:36+00:00
s3:winbind: Do not fallback to NCACN_NP Netlogon/LSA connections for AD domains
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15987
Pair-Programmed-With: Stefan Metzmacher <metze at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky at samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky at samba.org>
Autobuild-Date(master): Mon May 11 21:24:02 UTC 2026 on atb-devel-224
(cherry picked from commit 33628fd9da56afc0fa1a480b7df2f73e4e0d3664)
Autobuild-User(v4-23-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-23-test): Thu May 28 01:37:36 UTC 2026 on atb-devel-224
- - - - -
8c76f92d by Volker Lendecke at 2026-06-08T16:54:19+00:00
libsecurity: Fix security_acl_dup()'s talloc hierarchy
With claims and conditions, ACEs are no longer simple blobs, they
themselves are structures with talloc children. This means
talloc_memdup() is no longer sufficient to copy an ACE. Copy the whole
ACL via NDR.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=16095
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Noel Power <noel.power at suse.com>
Autobuild-User(master): Volker Lendecke <vl at samba.org>
Autobuild-Date(master): Mon Jun 8 11:47:54 UTC 2026 on atb-devel-224
(cherry picked from commit c137ec34c4aebf889943677f6426583029eb4cd4)
- - - - -
0129c019 by Gary Lockyer at 2026-06-08T16:54:19+00:00
lib:util add pointer overflow checks
The wrapping of pointer arithmetic is undefined behaviour. Clang from version
20 onwards will treat checks like:
ptr + offset < ptr
As always evaluating to true.
This commit adds the macros:
offset_outside_range
ptr_overflow
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16092
Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(Backported from commit 2e53f7196f45d28689f25a57fa84995eceee4585)
test_json_logging not present in v23
- - - - -
9bed3dc2 by Gary Lockyer at 2026-06-08T16:54:19+00:00
s3:libsmb:clilist fix tautological-compare
The wrapping of pointer arithmetic is undefined behaviour. Clang from version 20
onwards will treat an overflow check of the following form:
ptr + offset < ptr
as always evaluating to false.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16092
Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
- - - - -
4ff95725 by Gary Lockyer at 2026-06-08T16:54:19+00:00
libcli:auth:msrpc_parse fix white space
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16092
Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
- - - - -
3d115fd1 by Gary Lockyer at 2026-06-08T16:54:19+00:00
libcli:auth:msrpc_parse fix tautological-compare
The wrapping of pointer arithmetic is undefined behaviour. Clang from version 20
onwards will treat an overflow check of the following form:
ptr + offset < ptr
as always evaluating to false
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16092
Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit d80c9dac0765a5b114718450ec5a062cd2b6f86f)
- - - - -
da619c48 by Gary Lockyer at 2026-06-08T16:54:19+00:00
s3/torture/test_smb1_dfs fix tautological-compare
The wrapping of pointer arithmetic is undefined behaviour. Clang from version 20
onwards will treat an overflow check of the following form:
ptr + offset < ptr
as always evaluating to false.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16092
Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 769cf0a0ddb5c7af65afa5b764c24a3416025745)
- - - - -
2f0fe8c2 by Gary Lockyer at 2026-06-08T16:54:19+00:00
s3:utils:clirap2 fix tautological-compare
The wrapping of pointer arithmetic is undefined behaviour. Clang from version 20
onwards will treat an overflow check of the following form:
ptr + offset < ptr
as always evaluating to false
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16092
Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 3287641bbf3360c8241db090781ebc2d5febbc96)
- - - - -
f3bef4a8 by Gary Lockyer at 2026-06-08T16:54:19+00:00
s3:libsmb:cliquota fix tautological-compare
The wrapping of pointer arithmetic is undefined behaviour. Clang from version 20
onwards will treat an overflow check of the following form:
ptr + offset < ptr
as always evaluating to false
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16092
Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit b58d7045d5444d70db58d07d7746006ea1b9ecfb)
- - - - -
0d0a2097 by Gary Lockyer at 2026-06-08T16:54:19+00:00
build: enable tautological-compare errors
Now that all the warnings have been removed, and as they did in fact reveal
real issues lets make it an error.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16092
Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 3485f58ea1c2a4013b0ab60c1ddee0faa4eb3eea)
- - - - -
b1443f70 by Stefan Metzmacher at 2026-06-08T16:54:19+00:00
build: add -Werror=tautological-compare
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16092
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(Backported from commit fb188140357a5d8796c47c5fd88c8a25117bda8e)
-Werror=array-bounds and -Werror=stringop-overlow
- - - - -
16d92be9 by Stefan Metzmacher at 2026-06-08T18:07:49+00:00
s3:winbindd: ignore unsupported anonymous smb sessions for AD trusts
This is handles the cases where a DC has
'Require NTLMv2 session security' activated which
disables anonymous NTLMSSP and let the server return
NT_STATUS_NOT_SUPPORTED.
Similar problems happen with a Samba DC that
uses 'restrict anonymous = 2' and the
tcon to ipc$ fails with NT_STATUS_ACCESS_DENIED.
For active directory related trusts we only use
ncacn_ip_tcp (or ncalrpc), so there's no need for
a valid smb connection.
Historically it very hard to restructure the code
in order to only connect smb for ncacn_np, so
this is more a hack to let us work in real world
scenarios.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14638
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16067
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Bjoern Jacke <bjacke at samba.org>
(cherry picked from commit c63880a1ec3e930dca1a511f4610a94483418e01)
Autobuild-User(v4-23-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-23-test): Mon Jun 8 18:07:49 UTC 2026 on atb-devel-224
- - - - -
859038dd by Andreas Schneider at 2026-06-23T08:44:13+00:00
s3:tests: Improve debugging for test_wbinfo_lookuprids_cache.sh
Note that if this test fails, it is like something else creating keys.
The last time it was a crashing smbd which left a key in the database
and this test failed as a result.
BUG: https://bugzilla.samba.org/attachment.cgi?bugid=16011
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Guenther Deschner <gd at samba.org>
Autobuild-User(master): Günther Deschner <gd at samba.org>
Autobuild-Date(master): Wed Apr 22 16:35:58 UTC 2026 on atb-devel-224
(cherry picked from commit c24438ca972c98db533400d1afebc02fdc29bba6)
- - - - -
08090942 by Volker Lendecke at 2026-06-23T08:44:13+00:00
tests: Fix some wbinfo_lookuprids_cache flakyness
If the key contains spaces, the shell qouting through "testit" does
not work properly. Avoid having to fix that quoting by replacing
spaces with '\20'.
You can force it by setting the
my $samsid = "S-1-5-21-1-32-" . int(rand(4294967295));
in selftest/target/Samba3.pm.
BUG: https://bugzilla.samba.org/attachment.cgi?bugid=16011
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Guenther Deschner <gd at samba.org>
Autobuild-User(master): Günther Deschner <gd at samba.org>
Autobuild-Date(master): Mon Jun 8 14:49:01 UTC 2026 on atb-devel-224
(cherry picked from commit 27f57d26f950c6fbe62f9b8ef8bd5fb503f587e5)
- - - - -
a5f7550a by Volker Lendecke at 2026-06-23T08:44:13+00:00
tests: Fix samba4.blackbox.net_ads_join flakyness
We have to leave against the same DC that we joined against, the
replication cycle might not have kicked in.
Normally, the server affinity cache takes care of this, but in this
test it's disabled.
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit f5d858005a064a23321e78f68372eb1f8841fdc3)
- - - - -
332434df by Günther Deschner at 2026-06-23T08:44:13+00:00
s4-torture: add test for FILE_NOTIFY_CHANGE_SECURITY
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14148
Guenther
Signed-off-by: Guenther Deschner <gd at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
(cherry picked from commit 29e51f3ed935d0475b1715f82560ee356ab5e401)
- - - - -
97ad39f8 by Günther Deschner at 2026-06-23T09:52:39+00:00
s3-smbd: send notifications for ACL changes
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14148
Guenther
Signed-off-by: Guenther Deschner <gd at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
Autobuild-User(master): Jeremy Allison <jra at samba.org>
Autobuild-Date(master): Thu Nov 6 02:42:06 UTC 2025 on atb-devel-224
(cherry picked from commit 2be7c0c2f927042843fb8a2ea0b9c67d1f969d00)
Autobuild-User(v4-23-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-23-test): Tue Jun 23 09:52:39 UTC 2026 on atb-devel-224
- - - - -
6066bd2f by Björn Jacke at 2026-06-23T12:03:11+02:00
WHATSNEW: Add release notes for Samba 4.23.9.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
- - - - -
360b66d5 by Björn Jacke at 2026-06-23T12:03:59+02:00
VERSION: Disable GIT_SNAPSHOT for the 4.23.9 release.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
- - - - -
6a628e79 by Björn Jacke at 2026-06-23T12:04:59+02:00
VERSION: Bump version up to Samba 4.23.10...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
- - - - -
d2ef0ce0 by Stefan Metzmacher at 2026-07-20T17:20:30+02:00
CVE-2026-6949: ndr_dns: let ndr_pull_dns_res_rec() remember the start offset
In order to verify TSIG signatures we need a reliable way to
truncate the original dns_name_packet buffer before the
last additional dns_res_rec.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16083
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Douglas Bagnall <dbagnall at samba.org>
- - - - -
20798d41 by Stefan Metzmacher at 2026-07-20T17:20:30+02:00
CVE-2026-6949: s4:dns_server: correctly truncate the buffer for TSIG verification
Calculating the length of the TSIG additional dns_res_rec,
via ndr_push_dns_res_rec() is fragile and may generate
a buffer larger than the original dns_name_packet buffer.
This could underflow the resulting packet_len,
to a very large value and buffer_len to a small value.
Resulting in a memcpy() of a very large size into
a very small buffer. This most likely already
gets a segmentation fault when reading after the
in->data.
This was reported by Arjun Basnet with Securin Labs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16083
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Douglas Bagnall <dbagnall at samba.org>
- - - - -
8c979746 by Martin Schwenke at 2026-07-20T17:20:30+02:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
Protocol field lengths need to be validated to avoid attempts to
access memory beyond the end of the packet buffer.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Tristan Madani <tristan at talencesecurity.com>
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
94e1cec5 by Martin Schwenke at 2026-07-20T17:20:30+02:00
CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocation
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed. Variable i
could be reused but that might be confusing, so leave any optimisation
to the compiler.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Martin Schwenke <mschwenke at ddn.com>
Reported-by: Also Andrew Tridgell (issue 22)
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
b41a631f by Martin Schwenke at 2026-07-20T17:20:30+02:00
CVE-2026-58224: ctdb-daemon: Avoid out-of-bounds data access
Do not allow the VNN map's size to extend past the end of the buffer.
This is checked by switching to ctdb_vnn_map_pull(), which also
simplifies the code.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
de7ab1fd by Martin Schwenke at 2026-07-20T17:20:30+02:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
If a NUL terminator doesn't appear in the buffer then the database
name is not a valid string.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
9c060670 by Martin Schwenke at 2026-07-20T17:20:30+02:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
The count can't exceed the recdata buffer size.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
293fe0c9 by Martin Schwenke at 2026-07-20T17:20:30+02:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
The count can't exceed the indata buffer size.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
d686b157 by Martin Schwenke at 2026-07-20T17:20:30+02:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
The first check is clearly needed because m->db_id is referenced. The
second check is handled by a similar update to
ctdb_control_update_record(), but repeat it in case something else
changes.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
a1256fcd by Martin Schwenke at 2026-07-20T17:20:30+02:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
Instead of checking only that there is enough data for the length
field, check there is enough data for the entire header part of the
struct. After cross-checking overall lengths, ensure there is enough
data for the key/data in the data element.
While here, modernise the DEBUG.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Andrew Tridgell (issue 13)
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
843557f3 by Martin Schwenke at 2026-07-20T17:20:30+02:00
CVE-2026-58224: ctdb-protocol: Avoid off-by-one error for bytes pulled
As per the comment, if there is no NUL byte in the buffer then don't
count one in the number of bytes pulled.
Note that this is unlikely to be a security issue because it would
take a protocol bug elsewhere to overrun the buffer. However, include
this fix here for posterity.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Andrew Tridgell (issue 16)
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
467e96bf by Martin Schwenke at 2026-07-20T17:20:30+02:00
CVE-2026-58224: ctdb-protocol: Always pull the specified number of bytes
The string should not contain a premature NUL terminator, which would
cause less than the specified number of bytes to be pulled. If it
does, consume the specified number of bytes anyway. The alternative
doesn't make sense.
Note that this is unlikely to be a security issue, where trailing data
in the string field causes the buffer to be overrun. That would
require an additional protocol bug. However, include this fix here
for posterity.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
1e3c4a6b by Martin Schwenke at 2026-07-20T17:20:30+02:00
CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocations
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Andrew Tridgell (issue 22)
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
c056fcb0 by Martin Schwenke at 2026-07-20T17:20:30+02:00
CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocations
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
d6950d42 by Martin Schwenke at 2026-07-20T17:20:30+02:00
CVE-2026-58224: ctdb-common: Secure sock_daemon Unix domain sockets
Currently, the mode of the socket depends on the creating process's
umask. This might allow unwanted access.
It might be preferable to do this just for the eventd socket.
However, there is no useful place to hook this in outside of
sock_daemon.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
7f053069 by Martin Schwenke at 2026-07-20T17:20:30+02:00
CVE-2026-58224: ctdb-doc: Emphasise that the private network must be private
Note that the difference in the first couple of lines is leading
whitespace being switch to a TAB.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
85b6714b by Martin Schwenke at 2026-07-20T17:20:31+02:00
CVE-2026-58224: ctdb-common: Add comments to ward off vulnerability reports
We can't deal with this in the current CTDB protocol without
disproportionate effort. So, document reality clearly in the code to
try to stop these from being reported.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
4fb7188b by Douglas Bagnall at 2026-07-20T17:20:31+02:00
CVE-2026-58216: kdc:kpasswd: calculate correct size for password blob
We were making the enc_data_blob 6 bytes too big.
Its payload is an ASN.1 structure that knows its own size, so the
extra bytes are not usually read by Heimdal, but a crafted packet
could force them to be read.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16087
Reported-by: Tristan <TristanInSec at gmail.com>
Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
51a7e073 by Volker Lendecke at 2026-07-20T17:20:31+02:00
CVE-2026-58218: dns_server: Fix an error path memleak
We talloc the new key off "dns->tkeys", which is long-lived. On any
error we never free'd that again. Probably not remotely triggerable,
this is only setting up the gensec context.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16115
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Douglas Bagnall <dbagnall at samba.org>
- - - - -
9f9981bf by Volker Lendecke at 2026-07-20T17:20:31+02:00
CVE-2026-58218: dns_server: Only add a tkey after successful authentication
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16115
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Douglas Bagnall <dbagnall at samba.org>
- - - - -
a0081c81 by Stefan Metzmacher at 2026-07-20T17:20:31+02:00
CVE-2026-58221: s4:dsdb: provide dsdb_audit_{log_attributes,operation_human_readable}() functions
They are useful outside of audit_log.c soon.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16147
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
[backport: modified for v4.22, not removing the static versions used
in audit_log.c or adjusting the tests]
- - - - -
f0880127 by Stefan Metzmacher at 2026-07-20T17:20:31+02:00
CVE-2026-58221: s4:dsdb: let rootdse_filter_operations() reject untrusted operations on special DNs
Without this authenticated (also non-admin) users write internal meta
data leading to admin privileges.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16147
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
- - - - -
3ba20d57 by Stefan Metzmacher at 2026-07-21T17:02:52+02:00
CVE-2026-58222: s4:ldap_server: don't allow untrusted compare requests for confidential attributes
This means we apply acl checks against the search filter similar
to normal ldb searches.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16148
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
- - - - -
511485c9 by Björn Jacke at 2026-07-21T17:02:58+02:00
WHATSNEW: Add release notes for Samba 4.23.10.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
- - - - -
2f21145f by Björn Jacke at 2026-07-21T17:02:58+02:00
VERSION: Disable GIT_SNAPSHOT for the 4.23.10 release.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
- - - - -
58efc467 by Stefan Metzmacher at 2026-07-28T11:09:45+00:00
CVE-2026-6949: ndr_dns: let ndr_pull_dns_res_rec() remember the start offset
In order to verify TSIG signatures we need a reliable way to
truncate the original dns_name_packet buffer before the
last additional dns_res_rec.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16083
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Douglas Bagnall <dbagnall at samba.org>
- - - - -
9c64d367 by Stefan Metzmacher at 2026-07-28T11:09:45+00:00
CVE-2026-6949: s4:dns_server: correctly truncate the buffer for TSIG verification
Calculating the length of the TSIG additional dns_res_rec,
via ndr_push_dns_res_rec() is fragile and may generate
a buffer larger than the original dns_name_packet buffer.
This could underflow the resulting packet_len,
to a very large value and buffer_len to a small value.
Resulting in a memcpy() of a very large size into
a very small buffer. This most likely already
gets a segmentation fault when reading after the
in->data.
This was reported by Arjun Basnet with Securin Labs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16083
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Douglas Bagnall <dbagnall at samba.org>
- - - - -
f5c0d4b0 by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
Protocol field lengths need to be validated to avoid attempts to
access memory beyond the end of the packet buffer.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Tristan Madani <tristan at talencesecurity.com>
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
a58fe99a by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocation
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed. Variable i
could be reused but that might be confusing, so leave any optimisation
to the compiler.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Martin Schwenke <mschwenke at ddn.com>
Reported-by: Also Andrew Tridgell (issue 22)
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
d53d8581 by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-daemon: Avoid out-of-bounds data access
Do not allow the VNN map's size to extend past the end of the buffer.
This is checked by switching to ctdb_vnn_map_pull(), which also
simplifies the code.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
50e96112 by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
If a NUL terminator doesn't appear in the buffer then the database
name is not a valid string.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
277b66af by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
The count can't exceed the recdata buffer size.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
367d3298 by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
The count can't exceed the indata buffer size.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
c6faa697 by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
The first check is clearly needed because m->db_id is referenced. The
second check is handled by a similar update to
ctdb_control_update_record(), but repeat it in case something else
changes.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
ee014139 by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
Instead of checking only that there is enough data for the length
field, check there is enough data for the entire header part of the
struct. After cross-checking overall lengths, ensure there is enough
data for the key/data in the data element.
While here, modernise the DEBUG.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Andrew Tridgell (issue 13)
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
5694cd2a by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-protocol: Avoid off-by-one error for bytes pulled
As per the comment, if there is no NUL byte in the buffer then don't
count one in the number of bytes pulled.
Note that this is unlikely to be a security issue because it would
take a protocol bug elsewhere to overrun the buffer. However, include
this fix here for posterity.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Andrew Tridgell (issue 16)
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
aa36dba4 by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-protocol: Always pull the specified number of bytes
The string should not contain a premature NUL terminator, which would
cause less than the specified number of bytes to be pulled. If it
does, consume the specified number of bytes anyway. The alternative
doesn't make sense.
Note that this is unlikely to be a security issue, where trailing data
in the string field causes the buffer to be overrun. That would
require an additional protocol bug. However, include this fix here
for posterity.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
a65782f3 by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocations
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Andrew Tridgell (issue 22)
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
eeb740e3 by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocations
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
59fd658c by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-common: Secure sock_daemon Unix domain sockets
Currently, the mode of the socket depends on the creating process's
umask. This might allow unwanted access.
It might be preferable to do this just for the eventd socket.
However, there is no useful place to hook this in outside of
sock_daemon.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
b8a3cb40 by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-doc: Emphasise that the private network must be private
Note that the difference in the first couple of lines is leading
whitespace being switch to a TAB.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Tristan Madani <tristan at talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
017a3f33 by Martin Schwenke at 2026-07-28T11:09:45+00:00
CVE-2026-58224: ctdb-common: Add comments to ward off vulnerability reports
We can't deal with this in the current CTDB protocol without
disproportionate effort. So, document reality clearly in the code to
try to stop these from being reported.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
91c9696e by Douglas Bagnall at 2026-07-28T11:09:45+00:00
CVE-2026-58216: kdc:kpasswd: calculate correct size for password blob
We were making the enc_data_blob 6 bytes too big.
Its payload is an ASN.1 structure that knows its own size, so the
extra bytes are not usually read by Heimdal, but a crafted packet
could force them to be read.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16087
Reported-by: Tristan <TristanInSec at gmail.com>
Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
- - - - -
3f26fb69 by Volker Lendecke at 2026-07-28T11:09:45+00:00
CVE-2026-58218: dns_server: Fix an error path memleak
We talloc the new key off "dns->tkeys", which is long-lived. On any
error we never free'd that again. Probably not remotely triggerable,
this is only setting up the gensec context.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16115
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Douglas Bagnall <dbagnall at samba.org>
- - - - -
c83f5f8a by Volker Lendecke at 2026-07-28T11:09:45+00:00
CVE-2026-58218: dns_server: Only add a tkey after successful authentication
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16115
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Douglas Bagnall <dbagnall at samba.org>
- - - - -
62c456ff by Stefan Metzmacher at 2026-07-28T11:09:45+00:00
CVE-2026-58221: s4:dsdb: provide dsdb_audit_{log_attributes,operation_human_readable}() functions
They are useful outside of audit_log.c soon.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16147
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
[backport: modified for v4.22, not removing the static versions used
in audit_log.c or adjusting the tests]
- - - - -
96b7e948 by Stefan Metzmacher at 2026-07-28T11:09:45+00:00
CVE-2026-58221: s4:dsdb: let rootdse_filter_operations() reject untrusted operations on special DNs
Without this authenticated (also non-admin) users write internal meta
data leading to admin privileges.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16147
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
- - - - -
f393bce0 by Stefan Metzmacher at 2026-07-28T11:09:45+00:00
CVE-2026-58222: s4:ldap_server: don't allow untrusted compare requests for confidential attributes
This means we apply acl checks against the search filter similar
to normal ldb searches.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16148
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
- - - - -
ed48f38f by Björn Jacke at 2026-07-28T11:09:45+00:00
WHATSNEW: Add release notes for Samba 4.23.10.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
- - - - -
72d569ac by Björn Jacke at 2026-07-28T11:09:45+00:00
VERSION: Disable GIT_SNAPSHOT for the 4.23.10 release.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
- - - - -
0284546b by Björn Jacke at 2026-07-28T11:09:45+00:00
VERSION: Bump version up to Samba 4.23.11...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
- - - - -
ca081c92 by Andreas Schneider at 2026-07-28T11:09:45+00:00
s3:torture: Add libsmbclient set_credentials test
This checks if we can parse UPNs or DOMAIN\user provided usernames.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16149
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Noel Power <npower at samba.org>
(cherry picked from commit c12c825708a05918c5ee28bd127881ec5fb0aa38)
- - - - -
b4bf9e39 by Andreas Schneider at 2026-07-28T11:09:46+00:00
s3:libsmb: Parse the username string correctly
It could be a UPN or domain prefixed username.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16149
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Noel Power <npower at samba.org>
(cherry picked from commit 40b8d8c221258e8db10426a43ff57caacd5d48b0)
- - - - -
ddefd541 by Martin Schwenke at 2026-07-28T12:26:10+00:00
ctdb-server: Avoid removing connections for released IP
Commit c6602b686b4e50d93272667ef86d3904181fb1ab causes TCP connections
to be cleared whenever an associated client goes away. This shouldn't
happen when the associated public IP is being released, since the
takeover node will need the connection details to send tickle ACKs.
Sorry, I missed this when reviewing that commit.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15994
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Autobuild-User(master): Martin Schwenke <martins at samba.org>
Autobuild-Date(master): Wed Apr 29 02:58:12 UTC 2026 on atb-devel-224
(cherry picked from commit 9351c9f3b5a57239a7fbdd818e8ab72ecc469d9d)
Autobuild-User(v4-23-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-23-test): Tue Jul 28 12:26:10 UTC 2026 on atb-devel-224
- - - - -
5d772ed3 by Stefan Metzmacher at 2026-07-28T16:43:10+02:00
Merge tag 'samba-4.23.10' into v4-23-test
samba: tag release samba-4.23.10
- - - - -
b92408be by Martin Schwenke at 2026-07-28T14:44:22+00:00
ctdb-recoverd: Strengthen check for cluster lock held
This avoids attempting to start recovery without holding the cluster
lock.
There seems to be only one way the following can happen:
2026-05-12T12:15:51.127992+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:15:51.128019+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:15:51.128192+05:30 nsds1 ctdb-recoverd[826]: Attempting to take cluster lock (!/usr/libexec/ctdb/ctdb_mutex_fcntl_helper /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock 5 20)
2026-05-12T12:15:51.135578+05:30 nsds1 ctdbd[700]: ctdb_mutex_fcntl_helper: Unable to open /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock - (No such file or directory)
2026-05-12T12:15:51.135590+05:30 nsds1 ctdb-recoverd[826]: Unable to take cluster lock - unknown error
2026-05-12T12:15:56.130174+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:15:56.130206+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:15:56.130329+05:30 nsds1 ctdb-recoverd[826]: Attempting to take cluster lock (!/usr/libexec/ctdb/ctdb_mutex_fcntl_helper /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock 5 20)
2026-05-12T12:16:01.131882+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:16:01.131918+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:16:13.094308+05:30 nsds1 ctdbd[700]: ctdb_mutex_fcntl_helper: Unable to open /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock - (No such file or directory)
2026-05-12T12:16:13.094362+05:30 nsds1 ctdb-recoverd[826]: Unable to take cluster lock - unknown error
2026-05-12T12:16:13.094582+05:30 nsds1 ctdb-recoverd[826]: do_recovery: Starting do_recovery
2026-05-12T12:16:13.094591+05:30 nsds1 ctdb-recoverd[826]: Cluster lock not held - abort recovery, ban node
2026-05-12T12:16:13.094596+05:30 nsds1 ctdb-recoverd[826]: Banning node 0 for 300 seconds
2026-05-12T12:16:13.094612+05:30 nsds1 ctdbd[700]: Banning this node for 300 seconds
_cluster_lock_lock() sets rec->cluster_lock_handle during an attempt
to take the cluster look. This function contains a nested event loop
where other things can happen. Presumably the 3rd leader broadcast
timeout above occurs, starting a nested election (which also needs to
be avoided - this is the real root cause). cluster_lock_election()
then presumably finds that cluster_lock_held() returns true and sets
the leader to the current node.
However, the check in cluster_lock_held() is too weak and the "locked"
element must also be checked. As noted above, the nested elections
are the real issue but this is a belts-and-braces fix that should be
in place to avoid weirdness due to the nested event loop.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16152
Reported-by: Agam S <sagam at ddn.com>
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Amitay Isaacs <amitay at gmail.com>
(cherry picked from commit c3c250c9c8e3385f593e386f91e8579b8c89370a)
- - - - -
f769c28b by Martin Schwenke at 2026-07-28T14:44:23+00:00
ctdb-recoverd: Do not allow nested elections
This appears to show nested elections:
2026-05-12T12:15:56.130174+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:15:56.130206+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:15:56.130329+05:30 nsds1 ctdb-recoverd[826]: Attempting to take cluster lock (!/usr/libexec/ctdb/ctdb_mutex_fcntl_helper /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock 5 20)
2026-05-12T12:16:01.131882+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:16:01.131918+05:30 nsds1 ctdb-recoverd[826]: Start election
There is no sign that the first election ended. Starting another one
causes bad state interactions. Apart from causing confusion for
multiple pieces of state (e.g. rec->election_in_progress), a nested
call to _cluster_lock_lock() will leak rec->cluster_lock_handle
because it will overwrite it with the new in-progress handle.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16152
Reported-by: Agam S <sagam at ddn.com>
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Amitay Isaacs <amitay at gmail.com>
Autobuild-User(master): Amitay Isaacs <amitay at samba.org>
Autobuild-Date(master): Thu Jul 9 15:24:42 UTC 2026 on atb-devel-224
(cherry picked from commit d28f8ed17c867f306ca900bd912e8b75c5c7be8b)
- - - - -
219107af by Anoop C S at 2026-07-28T14:44:23+00:00
vfs_ceph_new: Include proxy setting in mount cache cookie
The mount cache cookie is derived from (conf_file/user_id/fsname) but
does not include the proxy mode. When two shares differ only in their
proxy setting, they produce the same cookie and share a single cached
ceph_mount_info. Since libcephfs.so and libcephfs_proxy.so define
struct ceph_mount_info with entirely different layouts, calling a
function resolved from one library on a mount allocated by the other
causes a segfault.
Add config->proxy to the cookie so that mounts created by different
libraries are never shared.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16186
Signed-off-by: Anoop C S <anoopcs at samba.org>
Reviewed-by: John Mulligan <jmulligan at redhat.com>
Reviewed-by: Guenther Deschner <gd at samba.org>
Autobuild-User(master): Anoop C S <anoopcs at samba.org>
Autobuild-Date(master): Fri Jul 24 15:56:49 UTC 2026 on atb-devel-224
(cherry picked from commit a1881f96f7309411087c3b4b3fe9db964a5ef644)
- - - - -
4d64a48b by Andreas Schneider at 2026-07-28T14:44:23+00:00
lib:compression: Fix _POSIX_C_SOURCE/_XOPEN_SOURCE redefinition issue
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16006
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit 39d53421d3b739f0c9911c18ad7c1251e84dd514)
- - - - -
ebdc52f9 by Andreas Schneider at 2026-07-28T14:44:23+00:00
lib/replace: add _ALIGNED_(n) as __attribute__((aligned(n)))
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16006
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit 1af38323e1b3d45093d9aaf64ffa00ae9520ab3b)
- - - - -
6f4761d9 by Stefan Metzmacher at 2026-07-28T14:44:23+00:00
s3:nmbd: fix stringop-overflow warnings
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16006
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
(cherry picked from commit 4f590a737be03c847885d70a3dadc9836e6e53d4)
- - - - -
7ce7585b by Andreas Schneider at 2026-07-28T14:44:23+00:00
libcli:auth: fix BURN_DATA_SIZE on array-decayed pointer parameter
_encode_pwd_buffer_from_str() declares `buf` as uint8_t buf[N],
which decays to a pointer. BURN_DATA_SIZE(buf, N) expands to
memset_explicit(&buf, 0, N), taking the address of the pointer
variable (8 bytes) rather than the buffer itself, triggering a
GCC -Wstringop-overflow error.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16006
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit 58059f27a64536731ae6f933c39de5f7d1b3f162)
- - - - -
2ceff98f by Andreas Schneider at 2026-07-28T14:44:23+00:00
charset: make strchr_m/strrchr_m/strstr_m const-correct via C11 _Generic
Since glibc-2.43 and C23, strchr/strrchr/strstr use _Generic macros to
return const char * when given const char * input. This caused build
failures in strchr_m and strrchr_m whose fast-path returns passed the
const char * result through as char *:
lib/util/charset/util_str.c:370: error: return discards 'const'
qualifier from pointer target type [-Werror=discarded-qualifiers]
Rather than wrapping the returns in discard_const_p (which the project
discourages adding more of), fix the API properly: rename the
implementations to strchr_m_const/strrchr_m_const/strstr_m_const
returning const char *, and expose C11 _Generic macros under the
original names. The macros preserve the caller's const qualification:
char * input yields char *, const char * input yields const char *.
This matches C23 strchr semantics and requires no changes at call sites.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16006
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit 5765fa4d322315b510ab9b3afa0179590cf570d9)
- - - - -
92317bf9 by Stefan Metzmacher at 2026-07-28T14:44:23+00:00
C26: const-qualify variables for read-only strchr/strrchr/strstr results
In C26, strchr/strrchr/strstr return const char * when given
const char * input. Add const to local variables that only
read through the pointer.
Pair-Programmed-With: Andreas Schneider <asn at samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16006
Signed-off-by: Andreas Schneider <asn at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
(backported from commit cb690b465adef7dc8cfccd4c1b0c1ea826c0a2ff)
[slow at samba.org: small conflict in source3/winbindd/winbindd_pam.c:generate_krb5_ccache()]
- - - - -
4b4f58a9 by Stefan Metzmacher at 2026-07-28T14:44:23+00:00
C26: use strchr_m/strrchr_m/strstr_m for multibyte-safe search
Replace strchr/strrchr/strstr with their multibyte-aware
Samba equivalents where appropriate. These wrappers return
char * regardless of input constness.
Pair-Programmed-With: Andreas Schneider <asn at samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16006
Signed-off-by: Andreas Schneider <asn at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit b5fd955ad5bf63b537076a9ef898c1954e767aad)
- - - - -
ab937530 by Stefan Metzmacher at 2026-07-28T14:44:23+00:00
C26: add C99 static to array function parameters
Use C99 static array size in function parameters (e.g. uint8_t buf[static 516])
to document minimum array size requirements and enable compiler diagnostics.
Pair-Programmed-With: Andreas Schneider <asn at samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16006
Signed-off-by: Andreas Schneider <asn at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit 68255504ffc00982a667affb406b8f36aaa85c7c)
- - - - -
2c56e3d2 by Stefan Metzmacher at 2026-07-28T14:44:23+00:00
C26: refactor to avoid modifying data via const pointer
Refactor code that assigns to a struct member, then calls strchr/strrchr on it
for in-place modification. Use a local mutable variable for modification, then
assign the final result to the struct member.
Pair-Programmed-With: Andreas Schneider <asn at samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16006
Signed-off-by: Andreas Schneider <asn at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit 536c9e8452148eb60c6ec098a934dc24f4d54faf)
- - - - -
f3e5e6b0 by Stefan Metzmacher at 2026-07-28T14:44:23+00:00
C26: add explicit casts where const must be stripped for mutation
For cases where code intentionally writes through a pointer returned by
strchr/strrchr/strstr, add explicit discard_const_p casts or adjust variable
types to non-const to make the mutability intent clear.
Pair-Programmed-With: Andreas Schneider <asn at samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16006
Signed-off-by: Andreas Schneider <asn at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit c94ae0f4b8e61492f949e558a721eb4a55e1f9e5)
[slow at samba.org: dropped change in source4/torture/krb5/kdc-canon-mit.csource4/torture/krb5/kdc-canon-mit.c]
- - - - -
c1d80c9f by Stefan Metzmacher at 2026-07-28T14:44:23+00:00
C26: update function signatures for const-correctness
Update function return types and parameter types to propagate const-correctness
through APIs affected by the C26 strchr/strstr changes.
Pair-Programmed-With: Andreas Schneider <asn at samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16006
Signed-off-by: Andreas Schneider <asn at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit 284e345586d1188f6d455868fe1af4659fe1b116)
- - - - -
6fe74530 by Stefan Metzmacher at 2026-07-28T14:44:23+00:00
s4:torture: let test_ndr_push_string() use strncmp() as strings might not be terminated
Otherwise this is not reliable.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16006
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Martin Schwenke <martin at meltin.net>
(cherry picked from commit 29cf4ee46be849ae880a77d77cc9c2116fd970b8)
- - - - -
29c35581 by Stefan Metzmacher at 2026-07-28T15:55:32+00:00
s3:winbindd: only call init_dc_connection_rpc() for NCACN_NP connections
As init_dc_connection_rpc() will return NT_STATUS_TRUSTED_DOMAIN_FAILURE
if domain->conn.cli is NULL and this is the case when we
have domain->conn.ignore_smb_disconnected as true.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14638
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16067
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16151
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Björn Jacke <bjacke at samba.org>
Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
Autobuild-Date(master): Fri Jun 26 16:10:29 UTC 2026 on atb-devel-224
(cherry picked from commit 23d1cab67b1c6f7d3cc4ead0d7a88ae809876001)
Autobuild-User(v4-23-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-23-test): Tue Jul 28 15:55:32 UTC 2026 on atb-devel-224
- - - - -
b4273914 by Stefan Metzmacher at 2026-07-30T22:09:13+00:00
s3:rpc_server/dfs: fix temporary read of unrelated or non-existing memory
This was reported by Arjun Basnet with Securin Labs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16093
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>
(cherry picked from commit 3b7730b3702875d92b5dc0e90410ae26c7355138)
- - - - -
f06a8849 by Stefan Metzmacher at 2026-07-30T22:09:13+00:00
s4:cracknames: make consistent use of ldb_binary_encode_string()
A client provided value can be passed into a filter
without going through ldb_binary_encode_string()
But the value is only appended via a to "name=%s",
so there's no leading "(", which means
in lib/ldb/common/ldb_parse.c:356: the value-parsing loop terminates
at the first unescaped ')', so a payload like "users)(hidden=*" collapses to
"(name=users)" with the trailing bytes silently discarded. An escaped "\)" makes
ldb_parse_tree() return NULL rather than admit injection. Combined with
LDB_SCOPE_ONELEVEL, the attribute list restricted to ["name"], and the fact that
a DRSUAPI-authenticated client can already issue arbitrary LDAP searches via
dcesrv_samdb_connect_as_user(), there is no escalation surface.
So this is only hardening helping AI to avoid reporting
false positives.
This was reported by Arjun Basnet with Securin Labs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16094
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>
(cherry picked from commit a7a5de8d951969d60a7f0c40798fc97f6ee873fa)
- - - - -
1c1fe53f by Matthias Grandl at 2026-07-30T23:11:46+00:00
vfs_ceph_snapshots: Fix panic on snapshot access with a "/"-rooted share
ceph_snap_gmt_convert_dir() builds an absolute snapshot path by joining
the share's connectpath, the request-relative name and the snapshot
subdir with '/' separators, then hands it to OpenDir(). OpenDir() ->
fd_openat() -> filename_convert_dirfsp_rel() splits the path on '/' and
openat_pathref_fsp_nosymlink() asserts that no component is empty:
SMB_ASSERT(rel_fname.base_name[0] != '\0') source3/smbd/files.c:1212
connectpath is a bare "/" when the share is mounted at the file system
root, so the join yields a leading "//" (e.g. "//.snap" or
"//dir/.snap"). That empty first component trips the assert and panics
smbd as soon as a snapshot is accessed.
Whether the malformed path actually reaches the assert also depends on
the Ceph client accepting a non-canonical "//" path in the preceding
stat(), so the panic is libcephfs-version dependent.
Canonicalize the .snap directory path with canonicalize_absolute_path()
after building it, so the path handed to OpenDir() is always canonical
and the empty leading component can no longer occur.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16176
Signed-off-by: Matthias Grandl <matthias.grandl at croit.io>
Reviewed-by: Anoop C S <anoopcs at samba.org>
Reviewed-by: David Disseldorp ddiss at samba.org
Autobuild-User(master): Anoop C S <anoopcs at samba.org>
Autobuild-Date(master): Tue Jul 21 16:12:18 UTC 2026 on atb-devel-224
(cherry picked from commit abb48aacbd994877006bf9156e633d3cf29a34bc)
Autobuild-User(v4-23-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-23-test): Thu Jul 30 23:11:46 UTC 2026 on atb-devel-224
- - - - -
5344c83e by Volker Lendecke at 2026-08-03T18:14:12+00:00
lib: Fix undefined behaviour at fork time in pthreadpool
If a pthread times out at the same time with a fork, ETIMEDOUT is
overwritten and not being taken care of. This means that we can race
with the forking thread destroying pool->condvar in the next round of
the thread's while(1) loop. pthread_cond_wait() on a condition
variable that has been destroyed is not a good idea.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16191
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Autobuild-User(master): Volker Lendecke <vl at samba.org>
Autobuild-Date(master): Thu Jul 30 17:51:29 UTC 2026 on atb-devel-224
(cherry picked from commit a13764ecad804539c8cad8ec84b41ef437fab4ac)
- - - - -
d1515c4b by Stefan Metzmacher at 2026-08-03T18:14:12+00:00
s3:libsmb: let dsgetdcname_rediscover() try process_dc_dns() before process_dc_netbios()
It's 2026 we typically have AD domains, and most of the time no nmbd
running.
So we should try CLDAP before falling back name_status_find(),
this allows us to detect that the domain is an AD domain even if
we searched with the netbios domain name.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16153
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
Autobuild-Date(master): Thu Jul 2 09:33:10 UTC 2026 on atb-devel-224
(cherry picked from commit 8bd496bf937d3a38482943e973a196f2c1f902a9)
- - - - -
d28d47c8 by Ralph Boehme at 2026-08-03T18:14:12+00:00
s4/torture: add torture_smb2_connection_share_ext()
Takes an additional share paramter compared to torture_smb2_connection_ext().
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Anoop C S <anoopcs at samba.org>
(cherry picked from commit a6d8c56ccc6d3d0cd714fa90f0c3fa54e2231eb0)
[metze at samba.org] Backported in order to let the patches for bug 16065
apply cleanly.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16065
Signed-off-by: Stefan Metzmacher <metze at samba.org>
- - - - -
7f4328f2 by Stefan Metzmacher at 2026-08-03T18:14:12+00:00
s4:py_net: make use of self->libnet_ctx->resolve_ctx
There's no need to call lpcfg_resolve_context() every time again.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16065
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit f5f80e04406b6f8e0cf810d7fd3d015e4e455051)
- - - - -
22b938b3 by Stefan Metzmacher at 2026-08-03T19:22:28+00:00
s4:libcli/resolve: let lpcfg_resolve_context() take an explicit mem_ctx
This avoids memory leaks in various places.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16065
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl at samba.org>
Autobuild-User(master): Volker Lendecke <vl at samba.org>
Autobuild-Date(master): Sat Aug 1 09:11:02 UTC 2026 on atb-devel-224
(cherry picked from commit 44008810a4b81baa9cbf63f0960ae1310afbb2a0)
Autobuild-User(v4-23-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-23-test): Mon Aug 3 19:22:28 UTC 2026 on atb-devel-224
- - - - -
07da29ad by Björn Jacke at 2026-08-03T21:30:21+02:00
WHATSNEW: Add release notes for Samba 4.23.11.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
- - - - -
41a080b9 by Björn Jacke at 2026-08-03T21:30:52+02:00
VERSION: Disable GIT_SNAPSHOT for the 4.23.11 release.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
- - - - -
c47e4989 by Michael Tokarev at 2026-08-04T00:28:08+03:00
d/upstream/signing-key.asc: update
- - - - -
67f12bf0 by Michael Tokarev at 2026-08-04T00:28:26+03:00
New upstream version 4.23.11+dfsg
- - - - -
9e5e235a by Michael Tokarev at 2026-08-04T00:28:43+03:00
Update upstream source from tag 'upstream/4.23.11+dfsg'
Update to upstream version '4.23.11+dfsg'
with Debian dir ae83e7a367e8b67e17238db7578f8c78f3cb1551
- - - - -
8afea8d6 by Michael Tokarev at 2026-08-04T00:47:54+03:00
Convert upstream signing-key to ascii
- - - - -
066978db by Michael Tokarev at 2026-08-04T00:47:57+03:00
update changelog; upload version 4.23.11+dfsg-1 to unstable
- - - - -
173 changed files:
- VERSION
- WHATSNEW.txt
- auth/credentials/credentials.c
- ctdb/protocol/protocol_util.c
- ctdb/server/ctdb_recoverd.c
- ctdb/server/ctdb_takeover.c
- debian/changelog
- debian/upstream/signing-key.asc
- examples/libsmbclient/testacl.c
- lib/addns/dnsquery_srv.c
- lib/cmdline/cmdline.c
- lib/compression/pycompression.c
- lib/ldb/common/ldb_ldif.c
- lib/ldb/common/ldb_modules.c
- lib/printer_driver/printer_driver.c
- lib/pthreadpool/pthreadpool.c
- lib/replace/replace.h
- lib/tdb/tools/tdbtool.c
- lib/util/base64.c
- lib/util/charset/charset.h
- lib/util/charset/util_str.c
- lib/util/dns_cmp.c
- lib/util/smb_strtox.c
- lib/util/util_net.c
- libcli/auth/netlogon_creds_cli.c
- libcli/auth/smbencrypt.c
- libcli/echo/tests/echo.c
- libcli/nbt/nbtname.c
- libcli/nbt/tools/nmblookup.c
- libcli/security/tests/test_sddl_conditional_ace.c
- librpc/rpc/binding.c
- nsswitch/libwbclient/tests/wbclient.c
- nsswitch/libwbclient/wbc_sid.c
- nsswitch/pam_winbind.c
- nsswitch/wbinfo.c
- source3/auth/auth_generic.c
- source3/auth/auth_util.c
- source3/auth/user_krb5.c
- source3/include/libsmbclient.h
- source3/lib/netapi/examples/common.c
- source3/lib/netapi/tests/common.c
- source3/lib/util.c
- source3/lib/wins_srv.c
- source3/libads/ads_proto.h
- source3/libads/kerberos_keytab.c
- source3/libads/ldap.c
- source3/libads/util.c
- source3/libsmb/cli_smb2_fnum.c
- source3/libsmb/cliconnect.c
- source3/libsmb/dsgetdcname.c
- source3/libsmb/libsmb_context.c
- source3/libsmb/libsmb_path.c
- source3/modules/nfs4acl_xattr_nfs.c
- source3/modules/vfs_ceph_new.c
- source3/modules/vfs_ceph_snapshots.c
- source3/modules/vfs_fruit.c
- source3/modules/vfs_media_harmony.c
- source3/modules/vfs_shadow_copy2.c
- source3/modules/vfs_streams_xattr.c
- source3/modules/vfs_unityed_media.c
- source3/modules/vfs_virusfilter.c
- source3/nmbd/nmbd.h
- source3/param/loadparm.h
- source3/param/util.c
- source3/passdb/lookup_sid.c
- source3/printing/nt_printing.c
- source3/printing/nt_printing_migrate.c
- source3/printing/print_iprint.c
- source3/rpc_server/dfs/srv_dfs_nt.c
- source3/rpc_server/fss/srv_fss_agent.c
- source3/rpc_server/ntsvcs/srv_ntsvcs_nt.c
- source3/rpc_server/rpc_host.c
- source3/rpc_server/spoolss/srv_spoolss_nt.c
- source3/smbd/filename.c
- source3/smbd/mangle_hash.c
- source3/smbd/mangle_hash2.c
- source3/smbd/msdfs.c
- source3/smbd/smb1_lanman.c
- source3/smbd/smb1_reply.c
- source3/torture/torture.c
- source3/utils/net_ads.c
- source3/utils/net_lookup.c
- source3/utils/net_rpc.c
- source3/utils/net_vfs.c
- source3/utils/ntlm_auth.c
- source3/utils/sharesec.c
- source3/utils/testparm.c
- source3/winbindd/idmap_nss.c
- source3/winbindd/idmap_tdb.c
- source3/winbindd/nss_info.c
- source3/winbindd/winbindd_cm.c
- source3/winbindd/winbindd_pam.c
- source3/winbindd/winbindd_util.c
- source4/client/cifsdd.c
- source4/client/client.c
- source4/dsdb/common/util.c
- source4/dsdb/common/util_trusts.c
- source4/dsdb/ft_scanner/ft_scanner_tdos.c
- source4/dsdb/samdb/cracknames.c
- source4/dsdb/samdb/ldb_modules/encrypted_secrets.c
- source4/dsdb/samdb/ldb_modules/partition_init.c
- source4/dsdb/samdb/ldb_modules/ranged_results.c
- source4/dsdb/samdb/ldb_modules/rootdse.c
- source4/dsdb/samdb/ldb_modules/samldb.c
- source4/kdc/kdc-proxy.c
- source4/lib/policy/gp_filesys.c
- source4/lib/registry/util.c
- source4/lib/socket/interface.c
- source4/lib/socket/socket_ip.c
- source4/libcli/ldap/ldap_client.c
- source4/libcli/resolve/resolve_lp.c
- source4/libnet/libnet.c
- source4/libnet/libnet_site.c
- source4/libnet/py_net.c
- source4/librpc/rpc/dcerpc_connect.c
- source4/nbt_server/wins/winsdb.c
- source4/ntvfs/cifs/vfs_cifs.c
- source4/ntvfs/ipc/vfs_ipc.c
- source4/ntvfs/ntvfs_generic.c
- source4/ntvfs/posix/pvfs_rename.c
- source4/ntvfs/posix/pvfs_resolve.c
- source4/ntvfs/posix/pvfs_shortname.c
- source4/ntvfs/posix/pvfs_sys.c
- source4/ntvfs/posix/vfs_posix.c
- source4/ntvfs/simple/svfs_util.c
- source4/ntvfs/simple/vfs_simple.c
- source4/rpc_server/lsa/lsa_init.c
- source4/rpc_server/lsa/lsa_lookup.c
- source4/smb_server/smb/service.c
- source4/torture/basic/base.c
- source4/torture/basic/misc.c
- source4/torture/drs/rpc/dssync.c
- source4/torture/gentest.c
- source4/torture/krb5/kdc-canon-heimdal.c
- source4/torture/ldap/cldap.c
- source4/torture/ldap/cldapbench.c
- source4/torture/ldap/netlogon.c
- source4/torture/libnet/libnet_BecomeDC.c
- source4/torture/libsmbclient/libsmbclient.c
- source4/torture/locktest.c
- source4/torture/masktest.c
- source4/torture/nbt/dgram.c
- source4/torture/nbt/nbt.c
- source4/torture/ndr/string.c
- source4/torture/raw/composite.c
- source4/torture/raw/lockbench.c
- source4/torture/raw/openbench.c
- source4/torture/raw/oplock.c
- source4/torture/raw/qfileinfo.c
- source4/torture/raw/session.c
- source4/torture/raw/tconrate.c
- source4/torture/rpc/fsrvp.c
- source4/torture/rpc/iremotewinspool_driver.c
- source4/torture/rpc/join.c
- source4/torture/rpc/lsa.c
- source4/torture/rpc/samba3rpc.c
- source4/torture/rpc/spoolss.c
- source4/torture/smb2/credits.c
- source4/torture/smb2/durable_open.c
- source4/torture/smb2/ioctl.c
- source4/torture/smb2/multichannel.c
- source4/torture/smb2/oplock.c
- source4/torture/smb2/replay.c
- source4/torture/smb2/scan.c
- source4/torture/smb2/session.c
- source4/torture/smb2/util.c
- source4/torture/smbtorture.c
- source4/torture/unix/unix_info2.c
- source4/torture/unix/whoami.c
- source4/torture/util_smb.c
- source4/torture/winbind/struct_based.c
- source4/utils/oLschema2ldif/lib.c
- third_party/resolv_wrapper/resolv_wrapper.c
The diff was not included because it is too large.
View it on GitLab: https://salsa.debian.org/samba-team/samba/-/compare/c695a728df1ad2fa6951face76b9f1d22af96e9b...066978dbe1c64c8b2569aaee8f4d21b44013c314
--
View it on GitLab: https://salsa.debian.org/samba-team/samba/-/compare/c695a728df1ad2fa6951face76b9f1d22af96e9b...066978dbe1c64c8b2569aaee8f4d21b44013c314
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-samba-maint/attachments/20260803/8ae79898/attachment-0001.htm>
More information about the Pkg-samba-maint
mailing list