{"id":"USN-5822-2","summary":"samba regression","details":"USN-5822-1 fixed vulnerabilities in Samba. The update for Ubuntu 20.04 LTS\nintroduced regressions in certain environments. Pending investigation of\nthese regressions, this update temporarily reverts the security fixes.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that Samba incorrectly handled the bad password count\n logic. A remote attacker could possibly use this issue to bypass bad\n passwords lockouts. This issue was only addressed in Ubuntu 22.10.\n (CVE-2021-20251)\n \n Evgeny Legerov discovered that Samba incorrectly handled buffers in\n certain GSSAPI routines of Heimdal. A remote attacker could possibly use\n this issue to cause Samba to crash, resulting in a denial of service.\n (CVE-2022-3437)\n \n Tom Tervoort discovered that Samba incorrectly used weak rc4-hmac Kerberos\n keys. A remote attacker could possibly use this issue to elevate\n privileges. (CVE-2022-37966, CVE-2022-37967)\n \n It was discovered that Samba supported weak RC4/HMAC-MD5 in NetLogon Secure\n Channel. A remote attacker could possibly use this issue to elevate\n privileges. (CVE-2022-38023)\n \n Greg Hudson discovered that Samba incorrectly handled PAC parsing. On\n 32-bit systems, a remote attacker could use this issue to escalate\n privileges, or possibly execute arbitrary code. (CVE-2022-42898)\n \n Joseph Sutton discovered that Samba could be forced to issue rc4-hmac\n encrypted Kerberos tickets. A remote attacker could possibly use this issue\n to escalate privileges. This issue only affected Ubuntu 20.04 LTS and\n Ubuntu 22.04 LTS. (CVE-2022-45141)\n \n WARNING: The fixes included in these updates introduce several important\n behavior changes which may cause compatibility problems interacting with\n systems still expecting the former behavior. Please see the following\n upstream advisories for more information:\n \n https://www.samba.org/samba/security/CVE-2022-37966.html\n https://www.samba.org/samba/security/CVE-2022-37967.html\n https://www.samba.org/samba/security/CVE-2022-38023.html\n","modified":"2026-02-10T04:42:55Z","published":"2023-01-26T21:36:01Z","related":["UBUNTU-CVE-2022-3437","UBUNTU-CVE-2022-37966","UBUNTU-CVE-2022-37967","UBUNTU-CVE-2022-38023","UBUNTU-CVE-2022-42898","UBUNTU-CVE-2022-45141"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-5822-2"},{"type":"REPORT","url":"https://launchpad.net/bugs/2003867"},{"type":"REPORT","url":"https://launchpad.net/bugs/2003891"}],"affected":[{"package":{"name":"samba","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/samba@2:4.13.17~dfsg-0ubuntu1.20.04.5?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.13.17~dfsg-0ubuntu1.20.04.5"}]}],"versions":["2:4.10.7+dfsg-0ubuntu2","2:4.10.7+dfsg-0ubuntu3","2:4.11.1+dfsg-3ubuntu1","2:4.11.1+dfsg-3ubuntu2","2:4.11.1+dfsg-3ubuntu4","2:4.11.5+dfsg-1ubuntu1","2:4.11.5+dfsg-1ubuntu2","2:4.11.6+dfsg-0ubuntu1","2:4.11.6+dfsg-0ubuntu1.1","2:4.11.6+dfsg-0ubuntu1.2","2:4.11.6+dfsg-0ubuntu1.3","2:4.11.6+dfsg-0ubuntu1.4","2:4.11.6+dfsg-0ubuntu1.5","2:4.11.6+dfsg-0ubuntu1.6","2:4.11.6+dfsg-0ubuntu1.8","2:4.11.6+dfsg-0ubuntu1.9","2:4.11.6+dfsg-0ubuntu1.10","2:4.13.14+dfsg-0ubuntu0.20.04.1","2:4.13.14+dfsg-0ubuntu0.20.04.2","2:4.13.14+dfsg-0ubuntu0.20.04.3","2:4.13.14+dfsg-0ubuntu0.20.04.4","2:4.13.17~dfsg-0ubuntu0.21.04.1","2:4.13.17~dfsg-0ubuntu0.21.04.2","2:4.13.17~dfsg-0ubuntu1.20.04.1","2:4.13.17~dfsg-0ubuntu1.20.04.2","2:4.13.17~dfsg-0ubuntu1.20.04.4"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"ctdb"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"libnss-winbind"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"libpam-winbind"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"libsmbclient"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"libsmbclient-dev"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"libwbclient-dev"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"libwbclient0"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"python3-samba"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"registry-tools"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"samba"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"samba-common"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"samba-common-bin"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"samba-dev"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"samba-dsdb-modules"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"samba-libs"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"samba-testsuite"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"samba-vfs-modules"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"smbclient"},{"binary_version":"2:4.13.17~dfsg-0ubuntu1.20.04.5","binary_name":"winbind"}]},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:20.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-5822-2.json"}}],"schema_version":"1.7.3"}