{"id":"CLSA-2026-1777945598","summary":"Fix CVE(s): CVE-2020-25717, CVE-2020-25719, CVE-2020-25722","details":"   * SECURITY UPDATE: domain user can become root on a domain member by\n     renaming a machine account\n     - debian/patches/CVE-2020-25717.patch: backport the el6/ol6 8-commit\n       subset (samba 3.6.23 precedent); introduce the new \"min domain\n       uid\" smb.conf parameter (default 1000) and enforce it in\n       check_account() so a domain logon resolving to a uid below the\n       threshold is rejected with NT_STATUS_INVALID_TOKEN, drop the\n       DOMAIN\\user to user prefix-stripping fallback in smb_getpwnam(),\n       stop autocreating local users from check_account() and from the\n       kerberos guest fallback by passing create=false, drop the\n       !winbind_ping() branch in create_local_token() so a missing\n       winbindd no longer silently switches the unix-token computation,\n       and require a PAC in any domain mode (DC or member) inside\n       gensec_generate_session_info_pac() returning\n       NT_STATUS_NO_IMPERSONATION_TOKEN otherwise (the gensec hunk is the\n       jointly tagged CVE-2020-25717+CVE-2020-25719 commit, so this\n       update also delivers the member-server portion of CVE-2020-25719;\n       the DC-side portion of CVE-2020-25719 is tracked separately under\n       ELSCVE-104393)\n     - CVE-2020-25717\n   * SECURITY UPDATE: privileged attribute escalation and structural\n     objectclass change in active directory ldap server\n     - debian/patches/CVE-2020-25722.patch: in\n       source4/dsdb/samdb/ldb_modules/objectclass.c, capture the current\n       structural objectclass at the start of objectclass_do_mod and\n       reject any modify that would change it; in\n       source4/dsdb/samdb/ldb_modules/samldb.c, factor the domain\n       ntSecurityDescriptor lookup into samldb_get_domain_secdesc() and\n       add samldb_check_sensitive_attributes() invoked from samldb_add()\n       and samldb_modify() to refuse non-system writes to sidHistory,\n       gate msDS-SecondaryKrbTgtNumber on the DS-Install-Replica\n       extended right, and gate msDS-AllowedToDelegateTo on\n       SePrivEnableDelegation\n     - CVE-2020-25722","modified":"2026-06-04T09:46:51.851041893Z","published":"2026-05-05T01:46:44Z","upstream":["CVE-2020-25717","CVE-2020-25719","CVE-2020-25722"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1777945598.html"}],"affected":[{"package":{"name":"ctdb","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/ctdb?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"libnss-winbind","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libnss-winbind?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"libpam-winbind","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libpam-winbind?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"libparse-pidl-perl","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libparse-pidl-perl?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"libsmbclient","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libsmbclient?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"libsmbclient-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libsmbclient-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"libwbclient-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libwbclient-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"libwbclient0","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libwbclient0?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"python-samba","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/python-samba?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"registry-tools","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/registry-tools?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"samba","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/samba?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"samba-common","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/samba-common?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"samba-common-bin","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/samba-common-bin?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"samba-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/samba-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"samba-dsdb-modules","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/samba-dsdb-modules?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"samba-libs","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/samba-libs?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"samba-testsuite","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/samba-testsuite?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"samba-vfs-modules","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/samba-vfs-modules?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"smbclient","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/smbclient?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}},{"package":{"name":"winbind","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/winbind?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json"}}],"schema_version":"1.7.5"}