Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 556
Alerts This Week
Warning Icon 1 556

Red Hat: RHSA-2022-2074-01 Moderate: Samba Information Leak

red hat
Calendar Grey May 10, 2022
Dist Redhat Esm H88
Red Hat issued a moderate Samba security update to fix bugs and enhance performance. This update is vital for system integrity and mitigating vulnerabilities
An update for samba is now available for Red Hat Enterprise Linux 8

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted automatically.

Summary

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.
The following packages have been upgraded to a later upstream version: samba (4.15.5). (BZ#2013596)
Security Fix(es):
* samba: Symlink race error can allow metadata read and modify outside of the exported share (CVE-2021-20316)
* samba: Information leak via symlinks of existance of files or directories outside of the exported share (CVE-2021-44141)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory information leak bug fix samba Red Hat Enterprise Linux moderate impact security risk

References

https://access.redhat.com/security/cve/CVE-2021-20316 https://access.redhat.com/security/cve/CVE-2021-44141 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/

Package List

Red Hat Enterprise Linux AppStream (v. 8):
aarch64: ctdb-debuginfo-4.15.5-5.el8.aarch64.rpm libsmbclient-debuginfo-4.15.5-5.el8.aarch64.rpm libwbclient-debuginfo-4.15.5-5.el8.aarch64.rpm python3-samba-debuginfo-4.15.5-5.el8.aarch64.rpm samba-client-debuginfo-4.15.5-5.el8.aarch64.rpm samba-client-libs-debuginfo-4.15.5-5.el8.aarch64.rpm samba-common-libs-debuginfo-4.15.5-5.el8.aarch64.rpm samba-common-tools-debuginfo-4.15.5-5.el8.aarch64.rpm samba-debuginfo-4.15.5-5.el8.aarch64.rpm samba-debugsource-4.15.5-5.el8.aarch64.rpm samba-krb5-printing-debuginfo-4.15.5-5.el8.aarch64.rpm samba-libs-debuginfo-4.15.5-5.el8.aarch64.rpm samba-test-debuginfo-4.15.5-5.el8.aarch64.rpm samba-test-libs-debuginfo-4.15.5-5.el8.aarch64.rpm samba-vfs-iouring-4.15.5-5.el8.aarch64.rpm samba-vfs-iouring-debuginfo-4.15.5-5.el8.aarch64.rpm samba-winbind-clients-debuginfo-4.15.5-5.el8.aarch64.rpm samba-winbind-debuginfo-4.15.5-5.el8.aarch64.rpm samba-winbind-krb5-locator-debuginfo-4.15.5-5.el8.aarch64.rpm samba-winbind-modules-debuginfo-4.15.5-5.el8.aarch64.rpm
ppc64le: ctdb-debuginfo-4.15.5-5.el8.ppc64le.rpm libsmbclient-debuginfo-4.15.5-5.el8.ppc64le.rpm libwbclient-debuginfo-4.15.5-5.el8.ppc64le.rpm python3-samba-debuginfo-4.15.5-5.el8.ppc64le.rpm samba-client-debuginfo-4.15.5-5.el8.ppc64le.rpm

Read the Full Advisory


Advisory ID: RHSA-2022:2074-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:2074
Issue date: 2022-05-10

Topic

An update for samba is now available for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory information leak bug fix samba Red Hat Enterprise Linux moderate impact security risk

Relevant Releases Architectures

Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

Bugs Fixed

1979959 - Samba autorid fails to map AD users if id rangesize fits in the id range only once

1995849 - [RFE] Change change password change prompt phrasing

1999294 - With "samba-4.13.3-4.el8_4.x86_64" there was error/message in the winbind service status . "open_internal_pipe: Could not connect to dssetup pipe: NT_STATUS_RPC_INTERFACE_NOT_FOUND" ; "DCERPC_NCA_S_OP_RNG_ERROR "

2009673 - CVE-2021-20316 samba: Symlink race error can allow metadata read and modify outside of the exported share

2013596 - Rebase Samba to the the latest 4.15.x release

2019461 - Directory containing dangling symlinks cannot be deleted.

2028029 - Winbindd crashes after NULL pointer dereference - missing return value check in winbindd_util.c:fill_domain_username_talloc()

2035528 - [smb] Segmentation fault when joining the domain

2038148 - Failed to authenticate users after upgrade samba package to release samba-4.14.5-7x

2038796 - filename_convert_internal: open_pathref_fsp [xxx] failed: NT_STATUS_ACCESS_DENIED

2043154 - smb.service: Got notification message from PID [pid1], but reception only permitted for main PID [pid2]

2044404 - Printing no longer works on Windows 7 with 2021-10 monthly rollup patch (KB5006743)

2046120 - CVE-2021-44141 samba: Information leak via symlinks of existance of files or directories outside of the exported share

2049602 - SAMBA: Disable NTLMSSP for ldap client connections (e.g. libads)

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.