Update to Samba 4.15.2

resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124
resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717
resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718
resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719
resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721
resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722
resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738
resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192
resolves: #2021625

Guenther
This commit is contained in:
Günther Deschner 2021-11-09 19:20:55 +01:00
parent 3c2c163325
commit 56ca6af06a
4 changed files with 83 additions and 85 deletions

2
.gitignore vendored
View File

@ -271,3 +271,5 @@ samba-3.6.0pre1.tar.gz
/samba-4.15.0.tar.asc /samba-4.15.0.tar.asc
/samba-4.15.1.tar.xz /samba-4.15.1.tar.xz
/samba-4.15.1.tar.asc /samba-4.15.1.tar.asc
/samba-4.15.2.tar.xz
/samba-4.15.2.tar.asc

View File

@ -1,4 +1,4 @@
From 7c4125deb1e03917f0a2353740f2c0e9e6cf87c5 Mon Sep 17 00:00:00 2001 From 0b196043f08ea4c025f19c4519175a3a73e1d185 Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com> From: Isaac Boukris <iboukris@gmail.com>
Date: Fri, 27 Sep 2019 18:25:03 +0300 Date: Fri, 27 Sep 2019 18:25:03 +0300
Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support
@ -6,13 +6,13 @@ Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support
Signed-off-by: Isaac Boukris <iboukris@gmail.com> Signed-off-by: Isaac Boukris <iboukris@gmail.com>
Pair-Programmed-With: Andreas Schneider <asn@samba.org> Pair-Programmed-With: Andreas Schneider <asn@samba.org>
--- ---
source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++++------------ source4/kdc/mit-kdb/kdb_samba_policies.c | 124 +++++++++++------------
source4/kdc/mit_samba.c | 47 ++----- source4/kdc/mit_samba.c | 47 ++-------
source4/kdc/mit_samba.h | 6 +- source4/kdc/mit_samba.h | 6 +-
3 files changed, 86 insertions(+), 115 deletions(-) 3 files changed, 71 insertions(+), 106 deletions(-)
diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c
index ac9865aac60..17d4c4028b9 100644 index f35210669c2..b1c7c5dcc5e 100644
--- a/source4/kdc/mit-kdb/kdb_samba_policies.c --- a/source4/kdc/mit-kdb/kdb_samba_policies.c
+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c
@@ -195,13 +195,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, @@ -195,13 +195,17 @@ static krb5_error_code ks_verify_pac(krb5_context context,
@ -133,16 +133,15 @@ index ac9865aac60..17d4c4028b9 100644
return code; return code;
} }
@@ -310,7 +321,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, @@ -314,6 +325,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
krb5_authdata ***signed_auth_data) krb5_authdata **pac_auth_data = NULL;
{
krb5_authdata **authdata = NULL; krb5_authdata **authdata = NULL;
- krb5_boolean is_as_req; krb5_boolean is_as_req;
+ krb5_const_principal pac_client; + krb5_const_principal pac_client;
krb5_error_code code; krb5_error_code code;
krb5_pac pac = NULL; krb5_pac pac = NULL;
krb5_data pac_data; krb5_data pac_data;
@@ -318,24 +329,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, @@ -325,11 +337,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt;
krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key;
@ -151,13 +150,13 @@ index ac9865aac60..17d4c4028b9 100644
- return KRB5_KDB_DBTYPE_NOSUP; - return KRB5_KDB_DBTYPE_NOSUP;
- } - }
- -
- is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
-
- if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) { /*
- code = ks_get_pac(context, client, client_key, &pac); @@ -390,6 +397,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- if (code != 0) { ks_client_princ = client->princ;
- goto done; }
- }
+ /* In protocol transition, we are currently not provided with the tgt + /* In protocol transition, we are currently not provided with the tgt
+ * client name to verify the PAC, we could probably skip the name + * client name to verify the PAC, we could probably skip the name
+ * verification and just verify the signatures, but since we don't + * verification and just verify the signatures, but since we don't
@ -165,59 +164,31 @@ index ac9865aac60..17d4c4028b9 100644
+ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { + if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) {
+ pac_client = server->princ; + pac_client = server->princ;
+ } else { + } else {
+ pac_client = client_princ; + pac_client = ks_client_princ;
}
- if (!is_as_req) {
+ /* TGS request */
+ if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY)) {
code = ks_verify_pac(context,
flags,
- client_princ,
+ pac_client,
client,
server,
krbtgt,
@@ -347,14 +355,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
if (code != 0) {
goto done;
}
+
+ /* We require PAC as we don't support LSA_TRUST_TYPE_MIT */
+ if (pac == NULL) {
+ code = KRB5_KDB_DBTYPE_NOSUP;
+ goto done;
+ }
}
- if (pac == NULL && client != NULL) {
+ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) {
+ krb5_pac_free(context, pac);
+ pac = NULL;
+ } + }
+
+ /* AS request or local realm protocol transition */ if (client_entry == NULL) {
+ if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) || client_entry = client;
+ (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) {
code = ks_get_pac(context, client, client_key, &pac);
if (code != 0) {
goto done;
}
+ /* We require a pac! */
+ SMB_ASSERT(pac != NULL);
} }
@@ -454,7 +471,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
if (pac == NULL) { code = ks_verify_pac(context,
@@ -363,7 +385,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, flags,
} - ks_client_princ,
+ pac_client,
code = krb5_pac_sign(context, pac, authtime, client_princ, client_entry,
server,
krbtgt,
@@ -494,7 +511,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
is_as_req ? "AS-REQ" : "TGS-REQ",
client_name);
code = krb5_pac_sign(context, pac, authtime, ks_client_princ,
- server_key, krbtgt_key, &pac_data); - server_key, krbtgt_key, &pac_data);
+ server_key, krbtgt_key, &pac_data); + server_key, krbtgt_key, &pac_data);
if (code != 0) { if (code != 0) {
DBG_ERR("krb5_pac_sign failed: %d\n", code); DBG_ERR("krb5_pac_sign failed: %d\n", code);
goto done; goto done;
@@ -389,11 +411,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, @@ -520,12 +537,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
KRB5_AUTHDATA_IF_RELEVANT, KRB5_AUTHDATA_IF_RELEVANT,
authdata, authdata,
signed_auth_data); signed_auth_data);
@ -226,10 +197,11 @@ index ac9865aac60..17d4c4028b9 100644
- } - }
- -
- code = 0; - code = 0;
-
done: done:
krb5_pac_free(context, pac); if (client_entry != NULL && client_entry != client) {
@@ -416,32 +433,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, ks_free_principal(context, client_entry);
@@ -551,32 +562,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
* server; -> delegating service * server; -> delegating service
* proxy; -> target principal * proxy; -> target principal
*/ */
@ -264,10 +236,10 @@ index ac9865aac60..17d4c4028b9 100644
diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
index 0a0d3a98315..5f35c6025bf 100644 index 4239332f0d9..acc3cba6254 100644
--- a/source4/kdc/mit_samba.c --- a/source4/kdc/mit_samba.c
+++ b/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c
@@ -493,7 +493,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, @@ -501,7 +501,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
krb5_context context, krb5_context context,
int flags, int flags,
@ -275,7 +247,7 @@ index 0a0d3a98315..5f35c6025bf 100644
krb5_db_entry *client, krb5_db_entry *client,
krb5_db_entry *server, krb5_db_entry *server,
krb5_db_entry *krbtgt, krb5_db_entry *krbtgt,
@@ -641,7 +640,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, @@ -665,7 +664,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
context, context,
*pac, *pac,
server->princ, server->princ,
@ -284,7 +256,7 @@ index 0a0d3a98315..5f35c6025bf 100644
deleg_blob); deleg_blob);
if (!NT_STATUS_IS_OK(nt_status)) { if (!NT_STATUS_IS_OK(nt_status)) {
DEBUG(0, ("Update delegation info failed: %s\n", DEBUG(0, ("Update delegation info failed: %s\n",
@@ -963,41 +962,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, @@ -987,41 +986,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
} }
int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
@ -337,7 +309,7 @@ index 0a0d3a98315..5f35c6025bf 100644
static krb5_error_code mit_samba_change_pwd_error(krb5_context context, static krb5_error_code mit_samba_change_pwd_error(krb5_context context,
diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h
index ba824557bd5..5aadf206443 100644 index 636c77ec97c..9cb00c9610e 100644
--- a/source4/kdc/mit_samba.h --- a/source4/kdc/mit_samba.h
+++ b/source4/kdc/mit_samba.h +++ b/source4/kdc/mit_samba.h
@@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, @@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
@ -361,10 +333,10 @@ index ba824557bd5..5aadf206443 100644
int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx,
char *pwd, char *pwd,
-- --
2.31.1 2.33.1
From b2ada81ed9f89f6b38fb0a9e54811408676671d0 Mon Sep 17 00:00:00 2001 From 992d38fa35c01f2f0bdb39d387fa29e8eb8d3d37 Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com> From: Isaac Boukris <iboukris@gmail.com>
Date: Fri, 27 Sep 2019 18:35:30 +0300 Date: Fri, 27 Sep 2019 18:35:30 +0300
Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build
@ -378,10 +350,10 @@ Pair-Programmed-With: Andreas Schneider <asn@samba.org>
3 files changed, 185 insertions(+), 13 deletions(-) 3 files changed, 185 insertions(+), 13 deletions(-)
diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
index 20ce86c708d..e72ab3c30f7 100644 index fff5b4e2a22..791b417d5ba 100644
--- a/lib/krb5_wrap/krb5_samba.c --- a/lib/krb5_wrap/krb5_samba.c
+++ b/lib/krb5_wrap/krb5_samba.c +++ b/lib/krb5_wrap/krb5_samba.c
@@ -2568,6 +2568,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, @@ -2694,6 +2694,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
return 0; return 0;
} }
@ -574,7 +546,7 @@ index 20ce86c708d..e72ab3c30f7 100644
#if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA)
diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h
index 9550447b2c5..ee3931c7544 100644 index eab67f6d969..b5385c69a33 100644
--- a/lib/krb5_wrap/krb5_samba.h --- a/lib/krb5_wrap/krb5_samba.h
+++ b/lib/krb5_wrap/krb5_samba.h +++ b/lib/krb5_wrap/krb5_samba.h
@@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, @@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx,
@ -639,10 +611,10 @@ index 544d9d853cc..c14d8c72d8c 100644
ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context,
ccache, ccache,
-- --
2.31.1 2.33.1
From bc5e97074739d29320a3e890575353fbfd452047 Mon Sep 17 00:00:00 2001 From f1951b501ca0fb3e613f04437c99dc1bbf204609 Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com> From: Isaac Boukris <iboukris@gmail.com>
Date: Sat, 19 Sep 2020 14:16:20 +0200 Date: Sat, 19 Sep 2020 14:16:20 +0200
Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code
@ -655,7 +627,7 @@ Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code
4 files changed, 11 insertions(+), 2 deletions(-) 4 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h
index 6a09ecb6fe1..bc5211fef35 100644 index 5ef9d9565f3..dafaffc6c2d 100644
--- a/source4/heimdal/lib/hdb/hdb.h --- a/source4/heimdal/lib/hdb/hdb.h
+++ b/source4/heimdal/lib/hdb/hdb.h +++ b/source4/heimdal/lib/hdb/hdb.h
@@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK }; @@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };
@ -667,7 +639,7 @@ index 6a09ecb6fe1..bc5211fef35 100644
/* hdb_capability_flags */ /* hdb_capability_flags */
#define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1 #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1
diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index a560a1cd84b..c27b6a8ef4c 100644 index aff74f2ee71..d16b4c3329a 100644
--- a/source4/kdc/db-glue.c --- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c +++ b/source4/kdc/db-glue.c
@@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, @@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
@ -695,7 +667,7 @@ index a560a1cd84b..c27b6a8ef4c 100644
ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL);
if (ret) { if (ret) {
diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
index 5f35c6025bf..20ee2c2b89e 100644 index acc3cba6254..f0b9df8b613 100644
--- a/source4/kdc/mit_samba.c --- a/source4/kdc/mit_samba.c
+++ b/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c
@@ -224,6 +224,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, @@ -224,6 +224,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx,
@ -721,5 +693,5 @@ index c929acccce6..a9115ec23d7 100644
void sdb_free_entry(struct sdb_entry_ex *e); void sdb_free_entry(struct sdb_entry_ex *e);
void free_sdb_entry(struct sdb_entry *s); void free_sdb_entry(struct sdb_entry *s);
-- --
2.31.1 2.33.1

View File

@ -129,9 +129,9 @@
%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
%global baserelease 1 %global baserelease 0
%global samba_version 4.15.1 %global samba_version 4.15.2
%global talloc_version 2.3.3 %global talloc_version 2.3.3
%global tdb_version 1.4.4 %global tdb_version 1.4.4
%global tevent_version 0.11.0 %global tevent_version 0.11.0
@ -2669,6 +2669,7 @@ fi
%{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc
%{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc
%{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc
%{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc
%{python3_sitearch}/samba/tests/__pycache__/dsdb_dns.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_dns.*.pyc
%{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc
%{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc
@ -2690,6 +2691,8 @@ fi
%{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc
%{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc
%{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc
%{python3_sitearch}/samba/tests/__pycache__/ldap_spn.*.pyc
%{python3_sitearch}/samba/tests/__pycache__/ldap_upn_sam_account.*.pyc
%{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc
%{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc
%{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc
@ -2861,6 +2864,7 @@ fi
%{python3_sitearch}/samba/tests/dns_tkey.py %{python3_sitearch}/samba/tests/dns_tkey.py
%{python3_sitearch}/samba/tests/dns_wildcard.py %{python3_sitearch}/samba/tests/dns_wildcard.py
%{python3_sitearch}/samba/tests/dsdb.py %{python3_sitearch}/samba/tests/dsdb.py
%{python3_sitearch}/samba/tests/dsdb_api.py
%{python3_sitearch}/samba/tests/dsdb_dns.py %{python3_sitearch}/samba/tests/dsdb_dns.py
%{python3_sitearch}/samba/tests/dsdb_lock.py %{python3_sitearch}/samba/tests/dsdb_lock.py
%{python3_sitearch}/samba/tests/dsdb_schema_attributes.py %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py
@ -2901,6 +2905,7 @@ fi
%{python3_sitearch}/samba/tests/kcc/ldif_import_export.py %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py
%dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5
%dir %{python3_sitearch}/samba/tests/krb5/__pycache__ %dir %{python3_sitearch}/samba/tests/krb5/__pycache__
%{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc
@ -2916,12 +2921,15 @@ fi
%{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/test_min_domain_uid.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/test_smb.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_smb.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc
%{python3_sitearch}/samba/tests/krb5/alias_tests.py
%{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py
%{python3_sitearch}/samba/tests/krb5/as_req_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py
%{python3_sitearch}/samba/tests/krb5/compatability_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py
@ -2937,8 +2945,10 @@ fi
%{python3_sitearch}/samba/tests/krb5/rodc_tests.py %{python3_sitearch}/samba/tests/krb5/rodc_tests.py
%{python3_sitearch}/samba/tests/krb5/salt_tests.py %{python3_sitearch}/samba/tests/krb5/salt_tests.py
%{python3_sitearch}/samba/tests/krb5/simple_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py
%{python3_sitearch}/samba/tests/krb5/spn_tests.py
%{python3_sitearch}/samba/tests/krb5/test_ccache.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py
%{python3_sitearch}/samba/tests/krb5/test_ldap.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py
%{python3_sitearch}/samba/tests/krb5/test_min_domain_uid.py
%{python3_sitearch}/samba/tests/krb5/test_rpc.py %{python3_sitearch}/samba/tests/krb5/test_rpc.py
%{python3_sitearch}/samba/tests/krb5/test_smb.py %{python3_sitearch}/samba/tests/krb5/test_smb.py
%{python3_sitearch}/samba/tests/krb5/s4u_tests.py %{python3_sitearch}/samba/tests/krb5/s4u_tests.py
@ -2946,6 +2956,8 @@ fi
%{python3_sitearch}/samba/tests/krb5_credentials.py %{python3_sitearch}/samba/tests/krb5_credentials.py
%{python3_sitearch}/samba/tests/ldap_raw.py %{python3_sitearch}/samba/tests/ldap_raw.py
%{python3_sitearch}/samba/tests/ldap_referrals.py %{python3_sitearch}/samba/tests/ldap_referrals.py
%{python3_sitearch}/samba/tests/ldap_spn.py
%{python3_sitearch}/samba/tests/ldap_upn_sam_account.py
%{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/libsmb.py
%{python3_sitearch}/samba/tests/loadparm.py %{python3_sitearch}/samba/tests/loadparm.py
%{python3_sitearch}/samba/tests/lsa_string.py %{python3_sitearch}/samba/tests/lsa_string.py
@ -4080,6 +4092,18 @@ fi
%endif %endif
%changelog %changelog
* Tue Nov 09 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.2-0
- Update to Samba 4.15.2
- resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124
- resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717
- resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718
- resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719
- resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721
- resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722
- resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738
- resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192
- resolves: #2021625
* Fri Nov 05 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.1-1 * Fri Nov 05 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.1-1
- Fix winexe core dump - Fix winexe core dump
- resolves: #2020376 - resolves: #2020376

View File

@ -1,2 +1,2 @@
SHA512 (samba-4.15.1.tar.xz) = 7422c4ed625411f8a4765f8e21f3b8e0c9d68f259cc25ed9f47e6243e849722ad6fa907fad989f19715ca799bc249cda4ef8a8bb930120d61851143072ef7558 SHA512 (samba-4.15.2.tar.xz) = d9aaabbf45ba0293dbda137a21f04d5fa533be07c3826de816513d8e2ae0ef6e6109ce4045dd74bcd5375364f6de5fa8ace6ae4b3c419bfffe55fa2bfeeb0d5d
SHA512 (samba-4.15.1.tar.asc) = 0fd0a9761b2dcbd43600490a32d462f50dcd42232a79e40c3a29df5630c9df412bdfac7aeb0eb34b8ce7a9a01ba8e0da612f5771fa9d45f12d77a4ae5c875d82 SHA512 (samba-4.15.2.tar.asc) = 732cc215c047988d4bce3d2ea981474f0cca44dd5a22030f49343aa3a37f6003bb84b116f7cdb0c8c4fd492354c107350f78101d7186fcb6027906ab1c92cf31