🛡️ SUSE-SU-2022:0323-1 — apparmor (CVE-2021-44141 +6 more)

Security update for samba

This update contains a major security update for Samba.

samba has received security fixes:

• CVE-2021-44141: Information leak via symlinks of existance of

files or directories outside of the exported share (bsc#1193690);

• CVE-2021-44142: Out-of-bounds heap read/write vulnerability

in VFS module vfs_fruit allows code execution (bsc#1194859);

• CVE-2022-0336: Samba AD users with permission to write to an

account can impersonate arbitrary services (bsc#1195048);

samba was updated to version 4.15.4; (jsc#SLE-23330);

+ CVE-2021-43566: Symlink race error can allow directory creation

outside of the exported share; (bso#13979); (bsc#1139519);

+ CVE-2021-20316: Symlink race error can allow metadata read and

modify outside of the exported share; (bso#14842); (bsc#1191227);

• Build samba with embedded talloc, pytalloc, pytalloc-util, tdb,

pytdb, tevent, pytevent, ldb, pyldb and pyldb-util libraries.

The tdb and ldb tools are installed in /usr/lib[64]/samba/bin and

their manpages in /usr/lib[64]/samba/man

This avoids removing old functionality.

samba was updated to 4.15.4:

• Duplicate SMB file_ids leading to Windows client cache

poisoning; (bso#14928);

• Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error -

NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);

• kill_tcp_connections does not work; (bso#14934);
• Can't connect to Windows shares not requiring authentication

using KDE/Gnome; (bso#14935);

• smbclient -L doesn't set 'client max protocol' to NT1 before

calling the 'Reconnecting with SMB1 for workgroup listing'

path; (bso#14939);

• Cross device copy of the crossrename module always fails;

(bso#14940);

• symlinkat function from VFS cap module always fails with an

error; (bso#14941);

• Fix possible fsp pointer deference; (bso#14942);
• Missing pop_sec_ctx() in error path inside close_directory();

(bso#14944);

• 'smbd --build-options' no longer works without an smb.conf file;

(bso#14945);

• Reorganize libs packages. Split samba-libs into samba-client-libs,

samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba

public libraries depending on internal samba libraries into these

packages as there were dependency problems everytime one of these

public libraries changed its version (bsc#1192684). The devel

packages are merged into samba-devel.

• Rename package samba-core-devel to samba-devel
• Update the symlink create by samba-dsdb-modules to private samba

ldb modules following libldb2 changes from /usr/lib64/ldb/samba to

/usr/lib64/ldb2/modules/ldb/samba

sssd was updated:

• Build with the newer samba versions; (jsc#SLE-23330);
• Fix a dependency loop by moving internal libraries to sssd-common

package; (bsc#1182058);

p11-kit was updated:

Update to 0.23.2; (jsc#SLE-23330);

• Fix forking issues with libffi
• Fix various crashes in corner cases
• Updated translations
• Build fixes
• Fix multiple integer overflows in rpc code (bsc#1180064 CVE-2020-29361):
• Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993)

ca-certificates was updated:

• p11-kit 0.23.1 supports pem-directory-hash. (jsc#SLE-23330)

This update also ships:

• libnettle 3.1 and gnutls 3.4.17 as parallel libraries to meet the requires of the newer samba.

apparmor was updated:

• Update samba apparmor profiles for samba 4.15 (jsc#SLE-23330);

yast2-samba-client was updated:

• With latest versions of samba (>=4.15.0) calling 'net ads lookup'

with '-U%' fails; (boo#1193533).

• yast-samba-client fails to join if /etc/samba/smb.conf or

/etc/krb5.conf don't exist; (bsc#1089938)

• Do not stop nmbd while nmbstatus is running, it is not necessary

anymore; (bsc#1158916);