| blob | 575ae48705f10b2fdb19d46eb5756dda597c2422 |
1 ===============================
2 Release Notes for Samba 4.13.13
3 October 29, 2021
4 ===============================
7 This is the latest stable release of the Samba 4.13 release series.
10 Changes since 4.13.12
11 ---------------------
13 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
14 * BUG 14868: rodc_rwdc test flaps.
15 * BUG 14881: Backport bronze bit fixes, tests, and selftest improvements.
17 o Andrew Bartlett <abartlet@samba.org>
18 * BUG 14642: Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze
19 bit' S4U2Proxy Constrained Delegation bypass in Samba with
20 embedded Heimdal.
21 * BUG 14836: Python ldb.msg_diff() memory handling failure.
22 * BUG 14845: "in" operator on ldb.Message is case sensitive.
23 * BUG 14848: Release LDB 2.3.1 for Samba 4.14.9.
24 * BUG 14871: Fix Samba support for UF_NO_AUTH_DATA_REQUIRED.
25 * BUG 14874: Allow special chars like "@" in samAccountName when generating
26 the salt.
27 * BUG 14881: Backport bronze bit fixes, tests, and selftest improvements.
29 o Isaac Boukris <iboukris@gmail.com>
30 * BUG 14642: Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze
31 bit' S4U2Proxy Constrained Delegation bypass in Samba with
32 embedded Heimdal.
33 * BUG 14881: Backport bronze bit fixes, tests, and selftest improvements.
35 o Viktor Dukhovni <viktor@twosigma.com>
36 * BUG 12998: Fix transit path validation.
37 * BUG 14881: Backport bronze bit fixes, tests, and selftest improvements.
39 o Luke Howard <lukeh@padl.com>
40 * BUG 14642: Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze
41 bit' S4U2Proxy Constrained Delegation bypass in Samba with
42 embedded Heimdal.
43 * BUG 14881: Backport bronze bit fixes, tests, and selftest improvements.
45 o Stefan Metzmacher <metze@samba.org>
46 * BUG 14881: Backport bronze bit fixes, tests, and selftest improvements.
48 o David Mulder <dmulder@suse.com>
49 * BUG 14881: Backport bronze bit fixes, tests, and selftest improvements.
51 o Andreas Schneider <asn@samba.org>
52 * BUG 14870: Prepare to operate with MIT krb5 >= 1.20.
53 * BUG 14881: Backport bronze bit fixes, tests, and selftest improvements.
55 o Joseph Sutton <josephsutton@catalyst.net.nz>
56 * BUG 14642: Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze
57 bit' S4U2Proxy Constrained Delegation bypass in Samba with
58 embedded Heimdal.
59 * BUG 14645: rpcclient NetFileEnum and net rpc file both cause lock order
60 violation: brlock.tdb, share_entries.tdb.
61 * BUG 14836: Python ldb.msg_diff() memory handling failure.
62 * BUG 14845: "in" operator on ldb.Message is case sensitive.
63 * BUG 14848: Release LDB 2.3.1 for Samba 4.14.9.
64 * BUG 14868: rodc_rwdc test flaps.
65 * BUG 14871: Fix Samba support for UF_NO_AUTH_DATA_REQUIRED.
66 * BUG 14874: Allow special chars like "@" in samAccountName when generating
67 the salt.
68 * BUG 14881: Backport bronze bit fixes, tests, and selftest improvements.
70 o Nicolas Williams <nico@twosigma.com>
71 * BUG 14642: Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze
72 bit' S4U2Proxy Constrained Delegation bypass in Samba with
73 embedded Heimdal.
74 * BUG 14881: Backport bronze bit fixes, tests, and selftest improvements.
77 #######################################
78 Reporting bugs & Development Discussion
79 #######################################
81 Please discuss this release on the samba-technical mailing list or by
82 joining the #samba-technical IRC channel on irc.freenode.net.
84 If you do report problems then please try to send high quality
85 feedback. If you don't provide vital information to help us track down
86 the problem then you will probably be ignored. All bug reports should
87 be filed under the Samba 4.1 and newer product in the project's Bugzilla
88 database (https://bugzilla.samba.org/).
91 ======================================================================
92 == Our Code, Our Bugs, Our Responsibility.
93 == The Samba Team
94 ======================================================================
97 Release notes for older releases follow:
98 ----------------------------------------
99 ===============================
100 Release Notes for Samba 4.13.12
101 September 22, 2021
102 ===============================
105 This is the latest stable release of the Samba 4.13 release series.
108 Changes since 4.13.11
109 ---------------------
111 o Andrew Bartlett <abartlet@samba.org>
112 * BUG 14806: Address a signifcant performance regression in database access
113 in the AD DC since Samba 4.12.
114 * BUG 14807: Fix performance regression in lsa_LookupSids3/LookupNames4 since
115 Samba 4.9 by using an explicit database handle cache.
116 * BUG 14817: An unuthenticated user can crash the AD DC KDC by omitting the
117 server name in a TGS-REQ.
118 * BUG 14818: Address flapping samba_tool_drs_showrepl test.
119 * BUG 14819: Address flapping dsdb_schema_attributes test.
121 o Björn Baumbach <bb@sernet.de>
122 * BUG 14817: An unuthenticated user can crash the AD DC KDC by omitting the
123 server name in a TGS-REQ
125 o Luke Howard <lukeh@padl.com>
126 * BUG 14817: An unuthenticated user can crash the AD DC KDC by omitting the
127 server name in a TGS-REQ.
129 o Volker Lendecke <vl@samba.org>
130 * BUG 14817: An unuthenticated user can crash the AD DC KDC by omitting the
131 server name in a TGS-REQ.
133 o Gary Lockyer <gary@catalyst.net.nz>
134 * BUG 14817: An unuthenticated user can crash the AD DC KDC by omitting the
135 server name in a TGS-REQ.
137 o Stefan Metzmacher <metze@samba.org>
138 * BUG 14817: An unuthenticated user can crash the AD DC KDC by omitting the
139 server name in a TGS-REQ.
141 o Andreas Schneider <asn@samba.org>
142 * BUG 14817: An unuthenticated user can crash the AD DC KDC by omitting the
143 server name in a TGS-REQ.
145 o Martin Schwenke <martin@meltin.net>
146 * BUG 14784: Fix CTDB flag/status update race conditions.
148 o Joseph Sutton <josephsutton@catalyst.net.nz>
149 * BUG 14817: An unuthenticated user can crash the AD DC KDC by omitting the
150 server name in a TGS-REQ.
153 #######################################
154 Reporting bugs & Development Discussion
155 #######################################
157 Please discuss this release on the samba-technical mailing list or by
158 joining the #samba-technical IRC channel on irc.freenode.net.
160 If you do report problems then please try to send high quality
161 feedback. If you don't provide vital information to help us track down
162 the problem then you will probably be ignored. All bug reports should
163 be filed under the Samba 4.1 and newer product in the project's Bugzilla
164 database (https://bugzilla.samba.org/).
167 ======================================================================
168 == Our Code, Our Bugs, Our Responsibility.
169 == The Samba Team
170 ======================================================================
173 ----------------------------------------------------------------------
176 ===============================
177 Release Notes for Samba 4.13.11
178 September 07, 2021
179 ===============================
182 This is the latest stable release of the Samba 4.13 release series.
185 Changes since 4.13.10
186 ---------------------
188 o Jeremy Allison <jra@samba.org>
189 * BUG 14769: smbd panic on force-close share during offload write.
191 o Ralph Boehme <slow@samba.org>
192 * BUG 14731: Fix returned attributes on fake quota file handle and avoid
193 hitting the VFS.
194 * BUG 14783: smbd "deadtime" parameter doesn't work anymore.
195 * BUG 14787: net conf list crashes when run as normal user.
197 o Stefan Metzmacher <metze@samba.org>
198 * BUG 14607: Work around special SMB2 READ response behavior of NetApp Ontap
199 7.3.7.
200 * BUG 14793: Start the SMB encryption as soon as possible.
202 o Andreas Schneider <asn@samba.org>
203 * BUG 14792: Winbind should not start if the socket path for the privileged
204 pipe is too long.
207 #######################################
208 Reporting bugs & Development Discussion
209 #######################################
211 Please discuss this release on the samba-technical mailing list or by
212 joining the #samba-technical IRC channel on irc.freenode.net.
214 If you do report problems then please try to send high quality
215 feedback. If you don't provide vital information to help us track down
216 the problem then you will probably be ignored. All bug reports should
217 be filed under the Samba 4.1 and newer product in the project's Bugzilla
218 database (https://bugzilla.samba.org/).
221 ======================================================================
222 == Our Code, Our Bugs, Our Responsibility.
223 == The Samba Team
224 ======================================================================
227 ----------------------------------------------------------------------
230 ===============================
231 Release Notes for Samba 4.13.10
232 July 14, 2021
233 ===============================
236 This is the latest stable release of the Samba 4.13 release series.
239 Changes since 4.13.9
240 --------------------
242 o Jeremy Allison <jra@samba.org>
243 * BUG 14708: s3: smbd: Ensure POSIX default ACL is mapped into returned
244 Windows ACL for directory handles.
245 * BUG 14721: Take a copy to make sure we don't reference free'd memory.
246 * BUG 14722: s3: lib: Fix talloc heirarcy error in parent_smb_fname().
247 * BUG 14736: s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
248 change_file_owner_to_parent() error path.
250 o Andrew Bartlett <abartlet@samba.org>
251 * BUG 14575: samba-tool: Give better error information when the
252 'domain backup restore' fails with a duplicate SID.
254 o Ralph Boehme <slow@samba.org>
255 * BUG 14714: smbd: Correctly initialize close timestamp fields.
256 * BUG 14740: Spotlight RPC service doesn't work with vfs_glusterfs.
258 o Volker Lendecke <vl@samba.org>
259 * BUG 14475: ctdb: Fix a crash in run_proc_signal_handler().
261 o Stefan Metzmacher <metze@samba.org>
262 * BUG 14750: gensec_krb5: Restore ipv6 support for kpasswd.
263 * BUG 14752: smbXsrv_{open,session,tcon}: Protect
264 smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records.
266 o Joseph Sutton <josephsutton@catalyst.net.nz>
267 * BUG 14027: samba-tool domain backup offline doesn't work against bind DLZ
268 backend.
269 * BUG 14669: netcmd: Use next_free_rid() function to calculate a SID for
270 restoring a backup.
273 #######################################
274 Reporting bugs & Development Discussion
275 #######################################
277 Please discuss this release on the samba-technical mailing list or by
278 joining the #samba-technical IRC channel on irc.freenode.net.
280 If you do report problems then please try to send high quality
281 feedback. If you don't provide vital information to help us track down
282 the problem then you will probably be ignored. All bug reports should
283 be filed under the Samba 4.1 and newer product in the project's Bugzilla
284 database (https://bugzilla.samba.org/).
287 ======================================================================
288 == Our Code, Our Bugs, Our Responsibility.
289 == The Samba Team
290 ======================================================================
293 ----------------------------------------------------------------------
296 ==============================
297 Release Notes for Samba 4.13.9
298 May 11, 2021
299 ==============================
302 This is the latest stable release of the Samba 4.13 release series.
305 Changes since 4.13.8
306 --------------------
308 o Jeremy Allison <jra@samba.org>
309 * BUG 14696: s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success.
311 o Andrew Bartlett <abartlet@samba.org>
312 * BUG 14689: Add documentation for dsdb_group_audit and dsdb_group_json_audit
313 to "log level", synchronise "log level" in smb.conf with the code.
315 o Ralph Boehme <slow@samba.org>
316 * BUG 14672: Fix smbd panic when two clients open same file.
317 * BUG 14675: Fix memory leak in the RPC server.
318 * BUG 14679: s3: smbd: Fix deferred renames.
320 o Samuel Cabrero <scabrero@samba.org>
321 * BUG 14675: s3-iremotewinspool: Set the per-request memory context.
323 o Volker Lendecke <vl@samba.org>
324 * BUG 14675: rpc_server3: Fix a memleak for internal pipes.
326 o Stefan Metzmacher <metze@samba.org>
327 * BUG 11899: third_party: Update socket_wrapper to version 1.3.2.
328 * BUG 14640: third_party: Update socket_wrapper to version 1.3.3.
331 o Christof Schmitt <cs@samba.org>
332 * BUG 14663: idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
333 conflict.
335 o Martin Schwenke <martin@meltin.net
336 * BUG 14288: Fix the build on OmniOS.
339 #######################################
340 Reporting bugs & Development Discussion
341 #######################################
343 Please discuss this release on the samba-technical mailing list or by
344 joining the #samba-technical IRC channel on irc.freenode.net.
346 If you do report problems then please try to send high quality
347 feedback. If you don't provide vital information to help us track down
348 the problem then you will probably be ignored. All bug reports should
349 be filed under the Samba 4.1 and newer product in the project's Bugzilla
350 database (https://bugzilla.samba.org/).
353 ======================================================================
354 == Our Code, Our Bugs, Our Responsibility.
355 == The Samba Team
356 ======================================================================
359 ----------------------------------------------------------------------
362 ==============================
363 Release Notes for Samba 4.13.8
364 April 29, 2021
365 ==============================
368 This is a security release in order to address the following defect:
370 o CVE-2021-20254: Negative idmap cache entries can cause incorrect group entries
371 in the Samba file server process token.
374 =======
375 Details
376 =======
378 o CVE-2021-20254:
379 The Samba smbd file server must map Windows group identities (SIDs) into unix
380 group ids (gids). The code that performs this had a flaw that could allow it
381 to read data beyond the end of the array in the case where a negative cache
382 entry had been added to the mapping cache. This could cause the calling code
383 to return those values into the process token that stores the group
384 membership for a user.
386 Most commonly this flaw caused the calling code to crash, but an alert user
387 (Peter Eriksson, IT Department, Linköping University) found this flaw by
388 noticing an unprivileged user was able to delete a file within a network
389 share that they should have been disallowed access to.
391 Analysis of the code paths has not allowed us to discover a way for a
392 remote user to be able to trigger this flaw reproducibly or on demand,
393 but this CVE has been issued out of an abundance of caution.
396 Changes since 4.13.7
397 --------------------
399 o Volker Lendecke <vl@samba.org>
400 * BUG 14571: CVE-2021-20254: Fix buffer overrun in sids_to_unixids().
403 #######################################
404 Reporting bugs & Development Discussion
405 #######################################
407 Please discuss this release on the samba-technical mailing list or by
408 joining the #samba-technical IRC channel on irc.freenode.net.
410 If you do report problems then please try to send high quality
411 feedback. If you don't provide vital information to help us track down
412 the problem then you will probably be ignored. All bug reports should
413 be filed under the Samba 4.1 and newer product in the project's Bugzilla
414 database (https://bugzilla.samba.org/).
417 ======================================================================
418 == Our Code, Our Bugs, Our Responsibility.
419 == The Samba Team
420 ======================================================================
423 ----------------------------------------------------------------------
426 ==============================
427 Release Notes for Samba 4.13.7
428 March 24, 2021
429 ==============================
432 This is a follow-up release to depend on the correct ldb version. This is only
433 needed when building against a system ldb library.
435 This is a security release in order to address the following defects:
437 o CVE-2020-27840: Heap corruption via crafted DN strings.
438 o CVE-2021-20277: Out of bounds read in AD DC LDAP server.
441 =======
442 Details
443 =======
445 o CVE-2020-27840:
446 An anonymous attacker can crash the Samba AD DC LDAP server by sending easily
447 crafted DNs as part of a bind request. More serious heap corruption is likely
448 also possible.
450 o CVE-2021-20277:
451 User-controlled LDAP filter strings against the AD DC LDAP server may crash
452 the LDAP server.
454 For more details, please refer to the security advisories.
457 Changes since 4.13.6
458 --------------------
460 o Release with dependency on ldb version 2.2.1.
463 #######################################
464 Reporting bugs & Development Discussion
465 #######################################
467 Please discuss this release on the samba-technical mailing list or by
468 joining the #samba-technical IRC channel on irc.freenode.net.
470 If you do report problems then please try to send high quality
471 feedback. If you don't provide vital information to help us track down
472 the problem then you will probably be ignored. All bug reports should
473 be filed under the Samba 4.1 and newer product in the project's Bugzilla
474 database (https://bugzilla.samba.org/).
477 ======================================================================
478 == Our Code, Our Bugs, Our Responsibility.
479 == The Samba Team
480 ======================================================================
483 ----------------------------------------------------------------------
486 ==============================
487 Release Notes for Samba 4.13.6
488 March 24, 2021
489 ==============================
492 This is a security release in order to address the following defects:
494 o CVE-2020-27840: Heap corruption via crafted DN strings.
495 o CVE-2021-20277: Out of bounds read in AD DC LDAP server.
498 =======
499 Details
500 =======
502 o CVE-2020-27840:
503 An anonymous attacker can crash the Samba AD DC LDAP server by sending easily
504 crafted DNs as part of a bind request. More serious heap corruption is likely
505 also possible.
507 o CVE-2021-20277:
508 User-controlled LDAP filter strings against the AD DC LDAP server may crash
509 the LDAP server.
511 For more details, please refer to the security advisories.
514 Changes since 4.13.5
515 --------------------
517 o Andrew Bartlett <abartlet@samba.org>
518 * BUG 14655: CVE-2021-20277: Fix out of bounds read in ldb_handler_fold.
520 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
521 * BUG 14595: CVE-2020-27840: Fix unauthenticated remote heap corruption via
522 bad DNs.
523 * BUG 14655: CVE-2021-20277: Fix out of bounds read in ldb_handler_fold.
526 #######################################
527 Reporting bugs & Development Discussion
528 #######################################
530 Please discuss this release on the samba-technical mailing list or by
531 joining the #samba-technical IRC channel on irc.freenode.net.
533 If you do report problems then please try to send high quality
534 feedback. If you don't provide vital information to help us track down
535 the problem then you will probably be ignored. All bug reports should
536 be filed under the Samba 4.1 and newer product in the project's Bugzilla
537 database (https://bugzilla.samba.org/).
540 ======================================================================
541 == Our Code, Our Bugs, Our Responsibility.
542 == The Samba Team
543 ======================================================================
546 ----------------------------------------------------------------------
549 ==============================
550 Release Notes for Samba 4.13.5
551 March 09, 2021
552 ==============================
555 This is the latest stable release of the Samba 4.13 release series.
558 Changes since 4.13.4
559 --------------------
561 o Trever L. Adams <trever.adams@gmail.com>
562 * BUG 14634: s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
563 start-up failure.
565 o Jeremy Allison <jra@samba.org>
566 * BUG 13992: s3: libsmb: Add missing cli_tdis() in error path if encryption
567 setup failed on temp proxy connection.
568 * BUG 14604: smbd: In conn_force_tdis_done() when forcing a connection closed
569 force a full reload of services.
571 o Andrew Bartlett <abartlet@samba.org>
572 * BUG 14593: dbcheck: Check Deleted Objects and reduce noise in reports about
573 expired tombstones.
575 o Ralph Boehme <slow@samba.org
576 * BUG 14503: s3: Fix fcntl waf configure check.
577 * BUG 14602: s3/auth: Implement "winbind:ignore domains".
578 * BUG 14617: smbd: Use fsp->conn->session_info for the initial
579 delete-on-close token.
581 o Peter Eriksson <pen@lysator.liu.se>
582 * BUG 14648: s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error
583 path.
585 o Björn Jacke <bj@sernet.de>
586 * BUG 14624: classicupgrade: Treat old never expires value right.
588 o Volker Lendecke <vl@samba.org>
589 * BUG 14636: g_lock: Fix uninitalized variable reads.
591 o Stefan Metzmacher <metze@samba.org>
592 * BUG 13898: s3:pysmbd: Fix fd leak in py_smbd_create_file().
594 o Andreas Schneider <asn@samba.org>
595 * BUG 14625: lib:util: Avoid free'ing our own pointer.
597 o Paul Wise <pabs3@bonedaddy.net>
598 * BUG 12505: HEIMDAL: krb5_storage_free(NULL) should work.
601 #######################################
602 Reporting bugs & Development Discussion
603 #######################################
605 Please discuss this release on the samba-technical mailing list or by
606 joining the #samba-technical IRC channel on irc.freenode.net.
608 If you do report problems then please try to send high quality
609 feedback. If you don't provide vital information to help us track down
610 the problem then you will probably be ignored. All bug reports should
611 be filed under the Samba 4.1 and newer product in the project's Bugzilla
612 database (https://bugzilla.samba.org/).
615 ======================================================================
616 == Our Code, Our Bugs, Our Responsibility.
617 == The Samba Team
618 ======================================================================
621 ----------------------------------------------------------------------
624 ==============================
625 Release Notes for Samba 4.13.4
626 January 26, 2021
627 ==============================
630 This is the latest stable release of the Samba 4.13 release series.
633 Changes since 4.13.3
634 --------------------
636 o Jeremy Allison <jra@samba.org>
637 * BUG 14607: Work around special SMB2 IOCTL response behavior of NetApp Ontap
638 7.3.7.
639 * BUG 14612: Temporary DFS share setup doesn't set case parameters in the
640 same way as a regular share definition does.
642 o Dimitry Andric <dimitry@andric.com>
643 * BUG 14605: lib: Avoid declaring zero-length VLAs in various messaging
644 functions.
646 o Andrew Bartlett <abartlet@samba.org>
647 * BUG 14579: Do not create an empty DB when accessing a sam.ldb.
649 o Ralph Boehme <slow@samba.org>
650 * BUG 14596: vfs_fruit may close wrong backend fd.
651 * BUG 14612: Temporary DFS share setup doesn't set case parameters in the
652 same way as a regular share definition does.
654 o Arne Kreddig <arne@kreddig.net>
655 * BUG 14606: vfs_virusfilter: Allocate separate memory for config char*.
657 o Stefan Metzmacher <metze@samba.org>
658 * BUG 14596: vfs_fruit may close wrong backend fd.
659 * BUG 14607: Work around special SMB2 IOCTL response behavior of NetApp Ontap
660 7.3.7.
662 o Andreas Schneider <asn@samba.org>
663 * BUG 14601: The cache directory for the user gencache should be created
664 recursively.
666 o Martin Schwenke <martin@meltin.net>
667 * BUG 14594: Be more flexible with repository names in CentOS 8 test
668 environments.
671 #######################################
672 Reporting bugs & Development Discussion
673 #######################################
675 Please discuss this release on the samba-technical mailing list or by
676 joining the #samba-technical IRC channel on irc.freenode.net.
678 If you do report problems then please try to send high quality
679 feedback. If you don't provide vital information to help us track down
680 the problem then you will probably be ignored. All bug reports should
681 be filed under the Samba 4.1 and newer product in the project's Bugzilla
682 database (https://bugzilla.samba.org/).
685 ======================================================================
686 == Our Code, Our Bugs, Our Responsibility.
687 == The Samba Team
688 ======================================================================
691 ----------------------------------------------------------------------
694 ==============================
695 Release Notes for Samba 4.13.3
696 December 15, 2020
697 ==============================
700 This is the latest stable release of the Samba 4.13 release series.
703 Changes since 4.13.2
704 --------------------
706 o Jeremy Allison <jra@samba.org>
707 * BUG 14210: libcli: smb2: Never print length if smb2_signing_key_valid()
708 fails for crypto blob.
709 * BUG 14486: s3: modules: gluster. Fix the error I made in preventing talloc
710 leaks from a function.
711 * BUG 14515: s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with
712 NULL via TALLOC_FREE().
713 * BUG 14568: s3: spoolss: Make parameters in call to user_ok_token() match
714 all other uses.
715 * BUG 14590: s3: smbd: Quiet log messages from usershares for an unknown
716 share.
718 o Ralph Boehme <slow@samba.org>
719 * BUG 14248: samba process does not honor max log size.
720 * BUG 14587: vfs_zfsacl: Add missing inherited flag on hidden "magic"
721 everyone@ ACE.
723 o Isaac Boukris <iboukris@gmail.com>
724 * BUG 13124: s3-libads: Pass timeout to open_socket_out in ms.
726 o Günther Deschner <gd@samba.org>
727 * BUG 14486: s3-vfs_glusterfs: Always disable write-behind translator.
729 o Volker Lendecke <vl@samba.org>
730 * BUG 14517: smbclient: Fix recursive mget.
731 * BUG 14581: clitar: Use do_list()'s recursion in clitar.c.
733 o Anoop C S <anoopcs@samba.org>
734 * BUG 14486: manpages/vfs_glusterfs: Mention silent skipping of write-behind
735 translator.
736 * BUG 14573: vfs_shadow_copy2: Preserve all open flags assuming ROFS.
738 o Jones Syue <jonessyue@qnap.com>
739 * BUG 14514: interface: Fix if_index is not parsed correctly.
742 #######################################
743 Reporting bugs & Development Discussion
744 #######################################
746 Please discuss this release on the samba-technical mailing list or by
747 joining the #samba-technical IRC channel on irc.freenode.net.
749 If you do report problems then please try to send high quality
750 feedback. If you don't provide vital information to help us track down
751 the problem then you will probably be ignored. All bug reports should
752 be filed under the Samba 4.1 and newer product in the project's Bugzilla
753 database (https://bugzilla.samba.org/).
756 ======================================================================
757 == Our Code, Our Bugs, Our Responsibility.
758 == The Samba Team
759 ======================================================================
762 ---------------------------------------------------------------------- ==============================
763 Release Notes for Samba 4.13.2
764 November 03, 2020
765 ==============================
768 This is the latest stable release of the Samba 4.13 release series.
770 Major enhancements include:
771 o BUG 14537: ctdb-common: Avoid aliasing errors during code optimization.
772 o BUG 14486: vfs_glusterfs: Avoid data corruption with the write-behind
773 translator.
776 =======
777 Details
778 =======
780 The GlusterFS write-behind performance translator, when used with Samba, could
781 be a source of data corruption. The translator, while processing a write call,
782 immediately returns success but continues writing the data to the server in the
783 background. This can cause data corruption when two clients relying on Samba to
784 provide data consistency are operating on the same file.
786 The write-behind translator is enabled by default on GlusterFS.
787 The vfs_glusterfs plugin will check for the presence of the translator and
788 refuse to connect if detected. Please disable the write-behind translator for
789 the GlusterFS volume to allow the plugin to connect to the volume.
792 Changes since 4.13.1
793 --------------------
795 o Jeremy Allison <jra@samba.org>
796 * BUG 14486: s3: modules: vfs_glusterfs: Fix leak of char
797 **lines onto mem_ctx on return.
799 o Ralph Boehme <slow@samba.org>
800 * BUG 14471: RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special.
802 o Alexander Bokovoy <ab@samba.org>
803 * BUG 14538: smb.conf.5: Add clarification how configuration changes
804 reflected by Samba.
805 * BUG 14552: daemons: Report status to systemd even when running in
806 foreground.
807 * BUG 14553: DNS Resolver: Support both dnspython before and after 2.0.0.
809 o Günther Deschner <gd@samba.org>
810 * BUG 14486: s3-vfs_glusterfs: Refuse connection when write-behind xlator is
811 present.
813 o Amitay Isaacs <amitay@gmail.com>
814 * BUG 14487: provision: Add support for BIND 9.16.x.
815 * BUG 14537: ctdb-common: Avoid aliasing errors during code optimization.
816 * BUG 14541: libndr: Avoid assigning duplicate versions to symbols.
818 o Björn Jacke <bjacke@samba.org>
819 * BUG 14522: docs: Fix default value of spoolss:architecture.
821 o Laurent Menase <laurent.menase@hpe.com>
822 * BUG 14388: winbind: Fix a memleak.
824 o Stefan Metzmacher <metze@samba.org>
825 * BUG 14531: s4:dsdb:acl_read: Implement "List Object" mode feature.
827 o Sachin Prabhu <sprabhu@redhat.com>
828 * BUG 14486: docs-xml/manpages: Add warning about write-behind translator for
829 vfs_glusterfs.
831 o Khem Raj <raj.khem@gmail.com>
832 * nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
834 o Anoop C S <anoopcs@samba.org>
835 * BUG 14530: vfs_shadow_copy2: Avoid closing snapsdir twice.
837 o Andreas Schneider <asn@samba.org>
838 * BUG 14547: third_party: Update resolv_wrapper to version 1.1.7.
839 * BUG 14550: examples:auth: Do not install example plugin.
841 o Martin Schwenke <martin@meltin.net>
842 * BUG 14513: ctdb-recoverd: Drop unnecessary and broken code.
844 o Andrew Walker <awalker@ixsystems.com>
845 * BUG 14471: RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special.
848 #######################################
849 Reporting bugs & Development Discussion
850 #######################################
852 Please discuss this release on the samba-technical mailing list or by
853 joining the #samba-technical IRC channel on irc.freenode.net.
855 If you do report problems then please try to send high quality
856 feedback. If you don't provide vital information to help us track down
857 the problem then you will probably be ignored. All bug reports should
858 be filed under the Samba 4.1 and newer product in the project's Bugzilla
859 database (https://bugzilla.samba.org/).
862 ======================================================================
863 == Our Code, Our Bugs, Our Responsibility.
864 == The Samba Team
865 ======================================================================
868 ----------------------------------------------------------------------
871 ==============================
872 Release Notes for Samba 4.13.1
873 October 29, 2020
874 ==============================
877 This is a security release in order to address the following defects:
879 o CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify.
880 o CVE-2020-14323: Unprivileged user can crash winbind.
881 o CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily
882 crafted records.
885 =======
886 Details
887 =======
889 o CVE-2020-14318:
890 The SMB1/2/3 protocols have a concept of "ChangeNotify", where a client can
891 request file name notification on a directory handle when a condition such as
892 "new file creation" or "file size change" or "file timestamp update" occurs.
894 A missing permissions check on a directory handle requesting ChangeNotify
895 meant that a client with a directory handle open only for
896 FILE_READ_ATTRIBUTES (minimal access rights) could be used to obtain change
897 notify replies from the server. These replies contain information that should
898 not be available to directory handles open for FILE_READ_ATTRIBUTE only.
900 o CVE-2020-14323:
901 winbind in version 3.6 and later implements a request to translate multiple
902 Windows SIDs into names in one request. This was done for performance
903 reasons: The Microsoft RPC call domain controllers offer to do this
904 translation, so it was an obvious extension to also offer this batch
905 operation on the winbind unix domain stream socket that is available to local
906 processes on the Samba server.
908 Due to improper input validation a hand-crafted packet can make winbind
909 perform a NULL pointer dereference and thus crash.
911 o CVE-2020-14383:
912 Some DNS records (such as MX and NS records) usually contain data in the
913 additional section. Samba's dnsserver RPC pipe (which is an administrative
914 interface not used in the DNS server itself) made an error in handling the
915 case where there are no records present: instead of noticing the lack of
916 records, it dereferenced uninitialised memory, causing the RPC server to
917 crash. This RPC server, which also serves protocols other than dnsserver,
918 will be restarted after a short delay, but it is easy for an authenticated
919 non-admin attacker to crash it again as soon as it returns. The Samba DNS
920 server itself will continue to operate, but many RPC services will not.
922 For more details, please refer to the security advisories.
925 Changes since 4.13.0
926 --------------------
928 o Jeremy Allison <jra@samba.org>
929 * BUG 14434: CVE-2020-14318: s3: smbd: Ensure change notifies can't get set
930 unless the directory handle is open for SEC_DIR_LIST.
932 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
933 * BUG 12795: CVE-2020-14383: Remote crash after adding NS or MX records using
934 'samba-tool'.
935 * BUG 14472: CVE-2020-14383: Remote crash after adding MX records.
937 o Volker Lendecke <vl@samba.org>
938 * BUG 14436: CVE-2020-14323: winbind: Fix invalid lookupsids DoS.
941 #######################################
942 Reporting bugs & Development Discussion
943 #######################################
945 Please discuss this release on the samba-technical mailing list or by
946 joining the #samba-technical IRC channel on irc.freenode.net.
948 If you do report problems then please try to send high quality
949 feedback. If you don't provide vital information to help us track down
950 the problem then you will probably be ignored. All bug reports should
951 be filed under the Samba 4.1 and newer product in the project's Bugzilla
952 database (https://bugzilla.samba.org/).
955 ======================================================================
956 == Our Code, Our Bugs, Our Responsibility.
957 == The Samba Team
958 ======================================================================
961 ----------------------------------------------------------------------
964 ==============================
965 Release Notes for Samba 4.13.0
966 September 22, 2020
967 ==============================
970 This is the first stable release of the Samba 4.13 release series.
971 Please read the release notes carefully before upgrading.
974 ZeroLogon
975 =========
977 Please avoid to set "server schannel = no" and "server schannel= auto" on all
978 Samba domain controllers due to the wellknown ZeroLogon issue.
980 For details please see
981 https://www.samba.org/samba/security/CVE-2020-1472.html.
984 NEW FEATURES/CHANGES
985 ====================
987 Python 3.6 or later required
988 ----------------------------
990 Samba's minimum runtime requirement for python was raised to Python
991 3.5 with samba 4.12. Samba 4.13 raises this minimum version to Python
992 3.6 both to access new features and because this is the oldest version
993 we test with in our CI infrastructure.
995 This is also the last release where it will be possible to build Samba
996 (just the file server) with Python versions 2.6 and 2.7.
998 As Python 2.7 has been End Of Life upstream since April 2020, Samba
999 is dropping ALL Python 2.x support in the NEXT release.
1001 Samba 4.14 to be released in March 2021 will require Python 3.6 or
1002 later to build.
1004 wide links functionality
1005 ------------------------
1007 For this release, the code implementing the insecure "wide links = yes"
1008 functionality has been moved out of the core smbd code and into a separate
1009 VFS module, vfs_widelinks. Currently this vfs module is implicitly loaded
1010 by smbd as the last but one module before vfs_default if "wide links = yes"
1011 is enabled on the share (note, the existing restrictions on enabling wide
1012 links around the SMB1 "unix extensions" and the "allow insecure wide links"
1013 parameters are still in force). The implicit loading was done to allow
1014 existing users of "wide links = yes" to keep this functionality without
1015 having to make a change to existing working smb.conf files.
1017 Please note that the Samba developers recommend changing any Samba
1018 installations that currently use "wide links = yes" to use bind mounts
1019 as soon as possible, as "wide links = yes" is an inherently insecure
1020 configuration which we would like to remove from Samba. Moving the
1021 feature into a VFS module allows this to be done in a cleaner way
1022 in future.
1024 A future release to be determined will remove this implicit linkage,
1025 causing administrators who need this functionality to have to explicitly
1026 add the vfs_widelinks module into the "vfs objects =" parameter lists.
1027 The release notes will be updated to note this change when it occurs.
1029 NT4-like 'classic' Samba domain controllers
1030 -------------------------------------------
1032 Samba 4.13 deprecates Samba's original domain controller mode.
1034 Sites using Samba as a Domain Controller should upgrade from the
1035 NT4-like 'classic' Domain Controller to a Samba Active Directory DC
1036 to ensure full operation with modern windows clients.
1038 SMBv1 only protocol options deprecated
1039 --------------------------------------
1041 A number of smb.conf parameters for less-secure authentication methods
1042 which are only possible over SMBv1 are deprecated in this release.
1045 REMOVED FEATURES
1046 ================
1048 The deprecated "ldap ssl ads" smb.conf option has been removed.
1051 smb.conf changes
1052 ================
1054 Parameter Name Description Default
1055 -------------- ----------- -------
1056 ldap ssl ads Removed
1057 smb2 disable lock sequence checking Added No
1058 smb2 disable oplock break retry Added No
1059 domain logons Deprecated no
1060 raw NTLMv2 auth Deprecated no
1061 client plaintext auth Deprecated no
1062 client NTLMv2 auth Deprecated yes
1063 client lanman auth Deprecated no
1064 client use spnego Deprecated yes
1065 server require schannel:COMPUTER Added
1068 CHANGES SINCE 4.13.0rc5
1069 =======================
1071 o Jeremy Allison <jra@samba.org>
1072 * BUG 14497: CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
1073 netr_ServerPasswordSet2 against unencrypted passwords.
1075 o Günther Deschner <gd@samba.org>
1076 * BUG 14497: CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
1077 "server require schannel:WORKSTATION$ = no" about unsecure configurations.
1079 o Gary Lockyer <gary@catalyst.net.nz>
1080 * BUG 14497: CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in
1081 client challenge.
1083 o Stefan Metzmacher <metze@samba.org>
1084 * BUG 14497: CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client
1085 challenges in netlogon_creds_server_init()
1086 "server require schannel:WORKSTATION$ = no".
1089 CHANGES SINCE 4.13.0rc4
1090 =======================
1092 o Andreas Schneider <asn@samba.org>
1093 * BUG 14399: waf: Only use gnutls_aead_cipher_encryptv2() for GnuTLS >
1094 3.6.14.
1095 * BUG 14467: s3:smbd: Fix %U substitutions if it contains a domain name.
1096 * BUG 14479: The created krb5.conf for 'net ads join' doesn't have a domain
1097 entry.
1099 o Stefan Metzmacher <metze@samba.org>
1100 * BUG 14482: Fix build problem if libbsd-dev is not installed.
1103 CHANGES SINCE 4.13.0rc3
1104 =======================
1106 o David Disseldorp <ddiss@samba.org>
1107 * BUG 14437: build: Toggle vfs_snapper using "--with-shared-modules".
1109 o Volker Lendecke <vl@samba.org>
1110 * BUG 14465: idmap_ad does not deal properly with a RFC4511 section 4.4.1
1111 response.
1113 o Stefan Metzmacher <metze@samba.org>
1114 * BUG 14428: PANIC: Assert failed in get_lease_type().
1115 * BUG 14465: idmap_ad does not deal properly with a RFC4511 section 4.4.1
1116 response.
1119 CHANGES SINCE 4.13.0rc2
1120 =======================
1122 o Andrew Bartlett <abartlet@samba.org>
1123 * BUG 14460: Deprecate domain logons, SMBv1 things.
1125 o Günther Deschner <gd@samba.org>
1126 * BUG 14318: docs: Add missing winexe manpage.
1128 o Christof Schmitt <cs@samba.org>
1129 * BUG 14166: util: Allow symlinks in directory_create_or_exist.
1131 o Martin Schwenke <martin@meltin.net>
1132 * BUG 14466: ctdb disable/enable can fail due to race condition.
1135 CHANGES SINCE 4.13.0rc1
1136 =======================
1138 o Andrew Bartlett <abartlet@samba.org>
1139 * BUG 14450: dbcheck: Allow a dangling forward link outside our known NCs.
1141 o Isaac Boukris <iboukris@gmail.com>
1142 * BUG 14462: Remove deprecated "ldap ssl ads" smb.conf option.
1144 o Volker Lendecke <vl@samba.org>
1145 * BUG 14435: winbind: Fix lookuprids cache problem.
1147 o Stefan Metzmacher <metze@samba.org>
1148 * BUG 14354: kdc:db-glue: Ignore KRB5_PROG_ETYPE_NOSUPP also for
1149 Primary:Kerberos.
1151 o Andreas Schneider <asn@samba.org>
1152 * BUG 14358: docs: Fix documentation for require_membership_of of
1153 pam_winbind.conf.
1155 o Martin Schwenke <martin@meltin.net>
1156 * BUG 14444: ctdb-scripts: Use nfsconf as a last resort get nfsd thread
1157 count.
1160 KNOWN ISSUES
1161 ============
1163 https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.13#Release_blocking_bugs
1166 #######################################
1167 Reporting bugs & Development Discussion
1168 #######################################
1170 Please discuss this release on the samba-technical mailing list or by
1171 joining the #samba-technical IRC channel on irc.freenode.net.
1173 If you do report problems then please try to send high quality
1174 feedback. If you don't provide vital information to help us track down
1175 the problem then you will probably be ignored. All bug reports should
1176 be filed under the Samba 4.1 and newer product in the project's Bugzilla
1177 database (https://bugzilla.samba.org/).
1180 ======================================================================
1181 == Our Code, Our Bugs, Our Responsibility.
1182 == The Samba Team
1183 ======================================================================