package/samba4: bump version to 4.8.5
PATCH 1/2 package/samba4: bump version to 4.8.5
From: Bernd Kuhls <[email protected]>
Release notes: https://www.samba.org/samba/history/samba-4.8.5.html
Rebased patches 0001 & 0004.
--- .../0001-libreplace-disable-libbsd-support.patch | 12 ++++++------ ...-Disable-build-of-manpages-and-documentation.patch | 19 +++++++++++++------ package/samba4/samba4.hash | 4 ++-- package/samba4/samba4.mk | 2 +- 4 files changed, 22 insertions(+), 15 deletions(-)
package/samba4/0001-libreplace-disable-libbsd-support.patch +6 -6
@@ -9,17 +9,17 @@ This causes redefinition conflicts for link(2) when both standard unistd.h and bsd/unistd.h get included. Signed-off-by: Gustavo Zacarias <[email protected]> -(rebased for versions 4.7.3 & 4.8.0) +[Bernd: rebased for versions 4.7.3, 4.8.0 & 4.8.5] Signed-off-by: Bernd Kuhls <[email protected]> --- - lib/replace/wscript | 12 ------------ - 1 file changed, 12 deletions(-) + lib/replace/wscript | 15 --------------- + 1 file changed, 15 deletions(-) diff --git a/lib/replace/wscript b/lib/replace/wscript -index 1dfd902..456be9b 100644 +index 6c7de5953f0..ac230d719f7 100644 --- a/lib/replace/wscript +++ b/lib/replace/wscript -@@ -296,21 +296,6 @@ +@@ -304,21 +304,6 @@ def configure(conf): strlcpy_in_bsd = False
@@ -42,5 +42,5 @@ index 1dfd902..456be9b 100644 struct ucred cred; socklen_t cred_len; -- -2.7.3 +2.18.0
package/samba4/0004-Disable-build-of-manpages-and-documentation.patch +13 -6
@@ -19,12 +19,13 @@ the build of manpages and documentation. Patch was downloaded from https://github.com/LibreELEC/LibreELEC.tv/blob/master/packages/network/samba/patches/samba-950-no-man.patch +[Bernd: rebased for samba-4.8.5] Signed-off-by: Bernd Kuhls <[email protected]> --- - buildtools/wafsamba/wafsamba.py | 10 +++++----- - docs-xml/wscript_build | 34 +++++++++++++++++----------------- + buildtools/wafsamba/wafsamba.py | 10 ++++----- + docs-xml/wscript_build | 40 ++++++++++++++++----------------- source4/scripting/wscript_build | 4 ++-- - 3 files changed, 24 insertions(+), 24 deletions(-) + 3 files changed, 27 insertions(+), 27 deletions(-) diff --git a/buildtools/wafsamba/wafsamba.py b/buildtools/wafsamba/wafsamba.py index 4bb19d070e2..a255d841111 100644
@@ -55,10 +56,10 @@ index 4bb19d070e2..a255d841111 100644 Build.BuildContext.SAMBA_BINARY = SAMBA_BINARY diff --git a/docs-xml/wscript_build b/docs-xml/wscript_build -index 954c62a29bc..1169158fd57 100644 +index ec5d28fc62a..f81c125bcd4 100644 --- a/docs-xml/wscript_build +++ b/docs-xml/wscript_build -@@ -147,20 +147,20 @@ bld.SAMBA_GENERATOR(parameter_all, +@@ -148,23 +148,23 @@ bld.SAMBA_GENERATOR(parameter_all, rule=smbdotconf_generate_parameter_list, dep_vars=bld.dynconfig_varnames())
@@ -77,6 +78,9 @@ index 954c62a29bc..1169158fd57 100644 - if bld.CONFIG_SET('HAVE_KRB5_LOCATE_PLUGIN_H'): - bld.SAMBAMANPAGES(krb5_locator_manpages) - +- if bld.CONFIG_SET('HAVE_KRB5_LOCALAUTH_PLUGIN_H'): +- bld.SAMBAMANPAGES(krb5_localauth_manpages) +- - if bld.SAMBA3_IS_ENABLED_MODULE('vfs_zfsacl'): - bld.SAMBAMANPAGES('manpages/vfs_zfsacl.8') +#def SMBDOTCONF_MANPAGE(bld, target):
@@ -94,6 +98,9 @@ index 954c62a29bc..1169158fd57 100644 +# if bld.CONFIG_SET('HAVE_KRB5_LOCATE_PLUGIN_H'): +# bld.SAMBAMANPAGES(krb5_locator_manpages) +# ++# if bld.CONFIG_SET('HAVE_KRB5_LOCALAUTH_PLUGIN_H'): ++# bld.SAMBAMANPAGES(krb5_localauth_manpages) ++# +# if bld.SAMBA3_IS_ENABLED_MODULE('vfs_zfsacl'): +# bld.SAMBAMANPAGES('manpages/vfs_zfsacl.8') diff --git a/source4/scripting/wscript_build b/source4/scripting/wscript_build
@@ -112,5 +119,5 @@ index 2f53cce12b7..9841ae0a116 100644 if bld.CONFIG_SET('AD_DC_BUILD_IS_ENABLED'): bld.INSTALL_FILES('${BINDIR}', -- -2.14.4 +2.18.0
package/samba4/samba4.hash +2 -2
@@ -1,4 +1,4 @@ # Locally calculated after checking pgp signature -# https://download.samba.org/pub/samba/stable/samba-4.8.4.tar.asc -sha256 f5044d149e01894a08b1d114b8b69aed78171a7bb19608bd1fd771453b9a5406 samba-4.8.4.tar.gz +# https://download.samba.org/pub/samba/stable/samba-4.8.5.tar.asc +sha256 e58ee6b1262d4128b8932ceee59d5f0b0a9bbe00547eb3cc4c41552de1a65155 samba-4.8.5.tar.gz sha256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903 COPYING
package/samba4/samba4.mk +1 -1
@@ -4,7 +4,7 @@ # ################################################################################ -SAMBA4_VERSION = 4.8.4 +SAMBA4_VERSION = 4.8.5 SAMBA4_SITE = https://download.samba.org/pub/samba/stable SAMBA4_SOURCE = samba-$(SAMBA4_VERSION).tar.gz SAMBA4_INSTALL_STAGING = YES
Signature · 1 line
2.11.0
PATCH 1/2 package/samba4: bump version to 4.8.5
Quoted 11 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
From: Bernd Kuhls <[email protected]>
Release notes: https://www.samba.org/samba/history/samba-4.8.5.htmlRebased patches 0001 & 0004.
Signed-off-by Bernd Kuhls <[email protected]>Signed-off-by Thomas Petazzoni <[email protected]>(cherry picked from commit 934d23bec79ca58a7c61239d5c4f64d26f8f5cd1)Signed-off-by Peter Korsgaard <[email protected]>
Committed to 2018.02.x and 2018.08.x, thanks.
Signature · 1 line
Bye, Peter Korsgaard
PATCH 2/2 samba4: security bump to version 4.8.7
In reply to Peter KorsgaardFixes the following security vulnerabilities:
- CVE-2018-14629:
All versions of Samba from 4.0.0 onwards are vulnerable to infinite query recursion caused by CNAME loops. Any dns record can be added via ldap by an unprivileged user using the ldbadd tool, so this is a security issue.
- CVE-2018-16841:
When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ.
This is only possible after authentication with a trusted certificate.
talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process.
There is no further vulnerability associated with this issue, merely a denial of service.
- CVE-2018-16851:
During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating the process.
There is no further vulnerability associated with this issue, merely a denial of service.
- CVE-2018-16853:
A user in a Samba AD domain can crash the KDC when Samba is built in the non-default MIT Kerberos configuration.
With this advisory we clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this configuration.
For more details, see the release notes:
https://www.samba.org/samba/history/samba-4.8.7.html
--- package/samba4/samba4.hash | 4 ++-- package/samba4/samba4.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
package/samba4/samba4.hash +2 -2
@@ -1,4 +1,4 @@ # Locally calculated after checking pgp signature -# https://download.samba.org/pub/samba/stable/samba-4.8.5.tar.asc -sha256 e58ee6b1262d4128b8932ceee59d5f0b0a9bbe00547eb3cc4c41552de1a65155 samba-4.8.5.tar.gz +# https://download.samba.org/pub/samba/stable/samba-4.8.7.tar.asc +sha256 0f6f67932e8bb23ab83b43070037ac452f9fc5f20763857d2b67e209ee7cd362 samba-4.8.7.tar.gz sha256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903 COPYING
package/samba4/samba4.mk +1 -1
@@ -4,7 +4,7 @@ # ################################################################################ -SAMBA4_VERSION = 4.8.5 +SAMBA4_VERSION = 4.8.7 SAMBA4_SITE = https://download.samba.org/pub/samba/stable SAMBA4_SOURCE = samba-$(SAMBA4_VERSION).tar.gz SAMBA4_INSTALL_STAGING = YES
Signature · 1 line
2.11.0
PATCH 2/2 samba4: security bump to version 4.8.7
Quoted 40 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes the following security vulnerabilities:
- CVE-2018-14629:
All versions of Samba from 4.0.0 onwards are vulnerable to infinite query recursion caused by CNAME loops. Any dns record can be added via ldap by an unprivileged user using the ldbadd tool, so this is a security issue.- CVE-2018-16841:
When configured to accept smart-card authentication, Samba's KDC will calltalloc_free()twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ.This is only possible after authentication with a trusted certificate.
talloc is robust against further corruption from a double-free with
talloc_free()and directly callsabort(), terminating the KDC process.There is no further vulnerability associated with this issue, merely a denial of service.
- CVE-2018-16851:
During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating the process.There is no further vulnerability associated with this issue, merely a denial of service.
- CVE-2018-16853:
A user in a Samba AD domain can crash the KDC when Samba is built in the non-default MIT Kerberos configuration.With this advisory we clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this configuration.
Quoted 5 lines
For more details, see the release notes:
https://www.samba.org/samba/history/samba-4.8.7.html
Signed-off-by Peter Korsgaard <[email protected]>
Committed to 2018.02.x and 2018.08.x, thanks.
Signature · 1 line
Bye, Peter Korsgaard