RHSA-2022:0008: Important: samba security update
Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.Security Fix(es): samba: Active Directory (AD) domain user could become root on domain members (CVE-2020-25717) samba: SMB1 client connections can be downgraded to plaintext authentication (CVE-2016-2124) samba: Subsequent DCE/RPC fragment injection vulnerability (CVE-2021-23192) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/ctdbto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/ctdb-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/ctdb-teststo a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/ctdb-tests-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/libsmbclientto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/libsmbclient-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/libwbclientto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/libwbclient-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/python3-sambato a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/python3-samba-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/python3-samba-testto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-clientto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-client-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-client-libsto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-client-libs-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-commonto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-common-libsto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-common-libs-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-common-toolsto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-common-tools-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-debugsourceto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-krb5-printingto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-krb5-printing-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-libsto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-libs-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-pidlto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-testto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-test-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-test-libsto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-test-libs-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-vfs-glusterfs-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-winbindto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-winbind-clientsto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-winbind-clients-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-winbind-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-winbind-krb5-locatorto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-winbind-krb5-locator-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-winbind-modulesto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-winbind-modules-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-winexeto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-winexe-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/ctdbto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/ctdb-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/ctdb-teststo a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/ctdb-tests-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/libsmbclientto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/libsmbclient-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/libwbclientto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/libwbclient-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/python3-sambato a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/python3-samba-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/python3-samba-testto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-clientto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-client-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-client-libsto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-client-libs-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-common-libsto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-common-libs-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-common-toolsto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-common-tools-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-debugsourceto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-krb5-printingto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-krb5-printing-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-libsto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-libs-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-testto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-test-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-test-libsto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-test-libs-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-winbindto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-winbind-clientsto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-winbind-clients-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-winbind-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-winbind-krb5-locatorto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-winbind-krb5-locator-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-winbind-modulesto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-winbind-modules-debuginfoto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/libsmbclient-develto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/libwbclient-develto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/samba-develto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/libsmbclient-develto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/libwbclient-develto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Upgrade
Upgrade
redhat/samba-develto a version that resolves this vulnerability.Fixed in 4.13.3-8.el8_4.aa - Compensating control
Mitigate Samba risk by preventing SMB1 downgrade to plaintext authentication (CVE-2016-2124), e.g., disable or block SMB1 so clients cannot use it.
- Compensating control
Mitigate Samba DCE/RPC fragment injection risk (CVE-2021-23192) by restricting/blocking SMB/RPC connectivity to untrusted networks/hosts until patched.
- Compensating control
Mitigate Samba Active Directory privilege escalation risk (CVE-2020-25717) by limiting access to Samba/SMB services from untrusted clients until the security update is installed.
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:0008?
The severity of RHSA-2022:0008 is classified as important.
How do I fix RHSA-2022:0008?
To fix RHSA-2022:0008, update your Samba installation to version 4.13.3-8.el8_4 or later.
What software is affected by RHSA-2022:0008?
RHSA-2022:0008 affects Samba and related packages such as ctdb, libsmbclient, and python3-samba.
What issues does RHSA-2022:0008 address?
RHSA-2022:0008 addresses vulnerabilities related to Active Directory and file sharing protocols in Samba.
Is there a way to check if my system is vulnerable to RHSA-2022:0008?
You can check your Samba version and compare it with the fixed version in RHSA-2022:0008 to determine vulnerability.