{"id":"SUSE-SU-2022:2307-1","summary":"Security update for ldb, samba","details":"This update for ldb, samba fixes the following issues:\n\nldb was updated to version 2.4.2 to fix:\n\n+ Fix for CVE-2021-3670, ensure that the LDB request has not\n  timed out during filter processing as the LDAP server\n  MaxQueryDuration is otherwise not honoured.\n\nsamba was updated to fix:\n\n- Revert NIS support removal; (bsc#1199247);\n\n- Use requires_eq macro to require the libldb2 version available at\n  samba-dsdb-modules build time; (bsc#1199362);\n\n- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);\n\nUpdate to 4.15.7\n\n* Share and server swapped in smbget password prompt; (bso#14831);\n* Durable handles won't reconnect if the leased file is written\n  to; (bso#15022);\n* rmdir silently fails if directory contains unreadable files and\n  hide unreadable is yes; (bso#15023);\n* SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information\n  on renamed file handle; (bso#15038);\n* vfs_shadow_copy2 breaks 'smbd async dosmode' sync fallback;\n  (bso#14957);\n* shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;\n  (bso#15035);\n* PAM Kerberos authentication incorrectly fails with a clock skew\n  error; (bso#15046);\n* username map - samba erroneously applies unix group memberships\n  to user account entries; (bso#15041);\n* NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES\n  in SMBC_server_internal; (bso#14983);\n* Simple bind doesn't work against an RODC (with non-preloaded users);\n  (bso#13879);\n* Crash of winbind on RODC; (bso#14641);\n* uncached logon on RODC always fails once; (bso#14865);\n* KVNO off by 100000; (bso#14951);\n* LDAP simple binds should honour 'old password allowed period';\n  (bso#15001);\n* wbinfo -a doesn't work reliable with upn names; (bso#15003);\n* Simple bind doesn't work against an RODC (with non-preloaded\n  users); (bso#13879);\n* Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);\n* Regression: create krb5 conf = yes doesn't work with a single KDC;\n  (bso#15016);\n\n- Add provides to samba-client-libs package to fix upgrades from\n  previous versions; (bsc#1197995);\n\n- Add missing samba-libs requirement to samba-winbind package;\n  (bsc#1198255);\n\nUpdate to 4.15.6\n\n* Renaming file on DFS root fails with\n  NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);\n* Samba does not response STATUS_INVALID_PARAMETER when opening 2\n  objects with same lease key; (bso#14737);\n* NT error code is not set when overwriting a file during rename\n  in libsmbclient; (bso#14938);\n* Fix ldap simple bind with TLS auditing; (bso#14996);\n* net ads info shows LDAP Server: 0.0.0.0 depending on contacted\n  server; (bso#14674);\n* Problem when winbind renews Kerberos; (bso#14979);\n  (bsc#1196224);\n* pam_winbind will not allow gdm login if password about to\n  expire; (bso#8691);\n* virusfilter_vfs_openat: Not scanned: Directory or special file;\n  (bso#14971);\n* DFS fix for AIX broken; (bso#13631);\n* Solaris and AIX acl modules: wrong function arguments;\n  (bso#14974);\n* Function aixacl_sys_acl_get_file not declared / coredump;\n  (bso#7239);\n* Regression: Samba 4.15.2 on macOS segfaults intermittently\n  during strcpy in tdbsam_getsampwnam; (bso#14900);\n* Fix a use-after-free in SMB1 server; (bso#14989);\n* smb2_signing_decrypt_pdu() may not decrypt with\n  gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;\n  (bso#14968);\n* Changing the machine password against an RODC likely destroys\n  the domain join; (bso#14984);\n* authsam_make_user_info_dc() steals memory from its struct\n  ldb_message *msg argument; (bso#14993);\n* Use Heimdal 8.0 (pre) rather than an earlier snapshot;\n  (bso#14995);\n* Samba autorid fails to map AD users if id rangesize fits in the\n  id range only once; (bso#14967);\n\nOther SUSE fixes:\n\n- Fix mismatched version of libldb2; (bsc#1196788).\n- Drop obsolete SuSEfirewall2 service files.\n- Drop obsolete Samba fsrvp v0-\u003ev1 state upgrade functionality; (bsc#1080338).\n- Fix ntlm authentications with 'winbind use default domain = yes';\n  (bso#13126); (bsc#1173429); (bsc#1196308).\n- Fix samba-ad-dc status warning notification message by disabling\n  systemd notifications in bgqd; (bsc#1195896); (bso#14947).\n- libldb version mismatch in Samba dsdb component; (bsc#1118508);\n","modified":"2026-03-11T07:20:14.542316Z","published":"2022-07-06T12:04:27Z","related":["CVE-2021-3670"],"upstream":["CVE-2021-3670"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222307-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1080338"},{"type":"REPORT","url":"https://bugzilla.suse.com/1118508"},{"type":"REPORT","url":"https://bugzilla.suse.com/1173429"},{"type":"REPORT","url":"https://bugzilla.suse.com/1195896"},{"type":"REPORT","url":"https://bugzilla.suse.com/1196224"},{"type":"REPORT","url":"https://bugzilla.suse.com/1196308"},{"type":"REPORT","url":"https://bugzilla.suse.com/1196788"},{"type":"REPORT","url":"https://bugzilla.suse.com/1197995"},{"type":"REPORT","url":"https://bugzilla.suse.com/1198255"},{"type":"REPORT","url":"https://bugzilla.suse.com/1199247"},{"type":"REPORT","url":"https://bugzilla.suse.com/1199362"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-3670"}],"affected":[{"package":{"name":"ldb","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","purl":"pkg:rpm/suse/ldb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150400.4.3.11"}]}],"ecosystem_specific":{"binaries":[{"samba-ceph":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-client-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-client":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","libldb-devel":"2.4.2-150400.4.3.11","libldb2":"2.4.2-150400.4.3.11","samba-dsdb-modules":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-python3":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-winbind-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","libsamba-policy-python3-devel":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-client-libs-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-libs-python3":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","ldb-tools":"2.4.2-150400.4.3.11","libldb2-32bit":"2.4.2-150400.4.3.11","libsamba-policy-devel":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","python3-ldb-devel":"2.4.2-150400.4.3.11","python3-ldb":"2.4.2-150400.4.3.11","samba-ad-dc-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-devel":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-ldb-ldap":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","libsamba-policy0-python3":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-gpupdate":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-libs-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-winbind":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2022:2307-1.json"}},{"package":{"name":"samba","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","purl":"pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3"}]}],"ecosystem_specific":{"binaries":[{"libldb-devel":"2.4.2-150400.4.3.11","samba-client-libs-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-devel":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-libs-python3":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-python3":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","libldb2-32bit":"2.4.2-150400.4.3.11","libldb2":"2.4.2-150400.4.3.11","libsamba-policy-devel":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","python3-ldb-devel":"2.4.2-150400.4.3.11","samba-client":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-winbind-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-winbind":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","libsamba-policy-python3-devel":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","libsamba-policy0-python3":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-ceph":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","python3-ldb":"2.4.2-150400.4.3.11","samba-ad-dc-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-client-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-dsdb-modules":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-gpupdate":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-ldb-ldap":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-libs-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","ldb-tools":"2.4.2-150400.4.3.11"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2022:2307-1.json"}},{"package":{"name":"samba","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","purl":"pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3"}]}],"ecosystem_specific":{"binaries":[{"ctdb":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2022:2307-1.json"}},{"package":{"name":"ldb","ecosystem":"openSUSE:Leap 15.4","purl":"pkg:rpm/opensuse/ldb&distro=openSUSE%20Leap%2015.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150400.4.3.11"}]}],"ecosystem_specific":{"binaries":[{"libldb-devel":"2.4.2-150400.4.3.11","libsamba-policy-python3-devel":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","libsamba-policy0-python3":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-ceph":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-client":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-devel":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-winbind":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","ctdb":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","libsamba-policy0-python3-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-ad-dc":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-client-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-libs-python3-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-python3":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-tool":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-winbind-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","python3-ldb-32bit":"2.4.2-150400.4.3.11","samba-ad-dc-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-client-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-client-libs-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-gpupdate":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-ldb-ldap":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","python3-ldb":"2.4.2-150400.4.3.11","samba-test":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","libsamba-policy-devel":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-ad-dc-libs-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","ctdb-pcp-pmda":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","libldb2-32bit":"2.4.2-150400.4.3.11","libldb2":"2.4.2-150400.4.3.11","samba-doc":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-dsdb-modules":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-libs-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","python3-ldb-devel":"2.4.2-150400.4.3.11","samba-libs-python3":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","ldb-tools":"2.4.2-150400.4.3.11","samba-devel-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-winbind-libs-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2022:2307-1.json"}},{"package":{"name":"samba","ecosystem":"openSUSE:Leap 15.4","purl":"pkg:rpm/opensuse/samba&distro=openSUSE%20Leap%2015.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3"}]}],"ecosystem_specific":{"binaries":[{"samba-gpupdate":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-tool":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-winbind-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-client-libs-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-doc":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-dsdb-modules":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-winbind":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-libs-python3":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","ctdb":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","libldb2-32bit":"2.4.2-150400.4.3.11","python3-ldb-32bit":"2.4.2-150400.4.3.11","samba-ad-dc-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-ad-dc":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-client-libs":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-python3":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","python3-ldb":"2.4.2-150400.4.3.11","samba-ad-dc-libs-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-test":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","libsamba-policy-devel":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","libsamba-policy0-python3":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-devel-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-winbind-libs-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","ctdb-pcp-pmda":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","libldb-devel":"2.4.2-150400.4.3.11","libsamba-policy-python3-devel":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-ceph":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-ldb-ldap":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-libs-python3-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","ldb-tools":"2.4.2-150400.4.3.11","libldb2":"2.4.2-150400.4.3.11","libsamba-policy0-python3-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","python3-ldb-devel":"2.4.2-150400.4.3.11","samba-devel":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-libs-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-client-32bit":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3","samba-client":"4.15.7+git.376.dd43aca9ab2-150400.3.5.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2022:2307-1.json"}}],"schema_version":"1.7.5"}