From 68bdc867b873bce8187aeb3990b95c08a507abda Mon Sep 17 00:00:00 2001 From: Jule Anger Date: Wed, 22 Mar 2023 10:13:09 +0100 Subject: WHATSNEW: Add release notes for Samba 4.17.7. Signed-off-by: Jule Anger --- WHATSNEW.txt | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 72 insertions(+), 2 deletions(-) diff --git a/WHATSNEW.txt b/WHATSNEW.txt index 865697ce109..694e29c45eb 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -1,3 +1,74 @@ + ============================== + Release Notes for Samba 4.17.7 + March 29, 2023 + ============================== + + +This is a security release in order to address the following defects: + +o CVE-2023-0225: An incomplete access check on dnsHostName allows authenticated + but otherwise unprivileged users to delete this attribute from + any object in the directory. + https://www.samba.org/samba/security/CVE-2023-0225.html + +o CVE-2023-0922: The Samba AD DC administration tool, when operating against a + remote LDAP server, will by default send new or reset + passwords over a signed-only connection. + https://www.samba.org/samba/security/CVE-2023-0922.html + +o CVE-2023-0614: The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 + Confidential attribute disclosure via LDAP filters was + insufficient and an attacker may be able to obtain + confidential BitLocker recovery keys from a Samba AD DC. + Installations with such secrets in their Samba AD should + assume they have been obtained and need replacing. + https://www.samba.org/samba/security/CVE-2023-0614.html + + +Changes since 4.17.6 +-------------------- + +o Douglas Bagnall + * BUG 15276: CVE-2023-0225. + +o Andrew Bartlett + * BUG 15270: CVE-2023-0614. + * BUG 15331: ldb wildcard matching makes excessive allocations. + * BUG 15332: large_ldap test is inefficient. + +o Rob van der Linde + * BUG 15315: CVE-2023-0922. + +o Joseph Sutton + * BUG 14810: CVE-2020-25720 [SECURITY] Create Child permission should not + allow full write to all attributes (additional changes). + * BUG 15270: CVE-2023-0614. + * BUG 15276: CVE-2023-0225. + + +####################################### +Reporting bugs & Development Discussion +####################################### + +Please discuss this release on the samba-technical mailing list or by +joining the #samba-technical:matrix.org matrix room, or +#samba-technical IRC channel on irc.libera.chat. + +If you do report problems then please try to send high quality +feedback. If you don't provide vital information to help us track down +the problem then you will probably be ignored. All bug reports should +be filed under the Samba 4.1 and newer product in the project's Bugzilla +database (https://bugzilla.samba.org/). + + +====================================================================== +== Our Code, Our Bugs, Our Responsibility. +== The Samba Team +====================================================================== + + +Release notes for older releases follow: +---------------------------------------- ============================== Release Notes for Samba 4.17.6 March 09, 2023 @@ -58,8 +129,7 @@ database (https://bugzilla.samba.org/). ====================================================================== -Release notes for older releases follow: ----------------------------------------- +---------------------------------------------------------------------- ============================== Release Notes for Samba 4.17.5 January 26, 2023 -- cgit v1.2.1