First Last Prev Next    This bug is not in your last search results.
Bug 55275 - samba: Security issue (5.0)
samba: Security issue (5.0)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 5.0
Other Linux
: P5 normal (vote)
: UCS 5.0-2-errata
Assigned To: Arvid Requate
Erik Damrose
https://bugzilla.samba.org/show_bug.c...
:
Depends on:
Blocks: 55276
  Show dependency tree / graph
 
Reported: 2022-10-17 11:31 CEST by Arvid Requate
Modified: 2022-10-25 14:36 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): Security
Max CVSS v3 score: 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L)
requate: Patch_Available+

Attachments
advisory (365 bytes, application/x-yaml)
2022-10-24 17:39 CEST, Erik Damrose 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Arvid Requate univentionstaff 2022-10-17 12:02:15 CEST 
r19708 | New upstream patch
r19709 | Adjust patch file extension for quilt


Package: samba
Version: 2:4.16.2-1A~5.0.0.202210171146
Branch: ucs_5.0-0
Scope: errata5.0-2
Comment 2 Erik Damrose univentionstaff 2022-10-19 15:15:16 CEST 
The fix at this bug is for the security issue:
CVE-2022-3437 Heimdal des/des3 overflow

At the same time another issue will be disclosed and released. But that issue only affects samba 4.17, which means that UCS is not affected:
CVE-2022-3592 A malicious client can use a symlink to escape the exported directory
Comment 3 Erik Damrose univentionstaff 2022-10-24 09:21:24 CEST 
OK: 98_CVE-2022-3437-des3-overflow-v4-4.16.quilt
OK: patch applied during build, samba 2:4.16.2-1A~5.0.0.202210171146
OK: Tests

We need an advisory for the release
Comment 4 Erik Damrose univentionstaff 2022-10-24 17:39:54 CEST 
Created attachment 10998 [details]
advisory
Comment 5 Erik Damrose univentionstaff 2022-10-24 17:42:03 CEST 
OK: Advisory
Verified
First Last Prev Next    This bug is not in your last search results.