Bug 297043 - net/samba423 upgrade to 4.23.11 ( fixes multiple CVEs )
Summary: net/samba423 upgrade to 4.23.11 ( fixes multiple CVEs )
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Xavier Beaudouin
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-07-25 09:39 UTC by Jordan Ostreff
Modified: 2026-08-07 06:52 UTC (History)
4 users (show)

See Also:
bugzilla: maintainer-feedback? (samba)


Attachments
net/samba423 4.23.9 upgrade ( still depends on lmdb0-0.9.35 ) (892 bytes, patch)
2026-07-25 09:39 UTC, Jordan Ostreff
no flags Details | Diff
net/samba423 4.23.10 upgrade depends on lmdb (1.35 KB, patch)
2026-08-02 12:03 UTC, Jordan Ostreff
no flags Details | Diff
net/samba423 4.23.11 upgrade depends on lmdb (1.35 KB, patch)
2026-08-04 18:53 UTC, Jordan Ostreff
jordan: maintainer-approval?
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jordan Ostreff 2026-07-25 09:39:42 UTC
Created attachment 273164 [details]
net/samba423 4.23.9 upgrade ( still depends on lmdb0-0.9.35 )

Changes since 4.23.8
--------------------

o  Ralph Boehme <slow@samba.org>
   * BUG 16030: Windows Offline Files fails with permission error when directory
     has the read‑only attribute set

o  Günther Deschner <gd@samba.org>
   * BUG 14148: Samba doesn't implement FILE_NOTIFY_CHANGE_SECURITY

o  Björn Jacke <bjacke@samba.org>
   * BUG 16076: samba-tool shows wrong format specifiers for timestamp
     attributes

o  Volker Lendecke <vl@samba.org>
   * BUG 16095: Use-after-free in handling acls with claims and conditions

o  Gary Lockyer <gary@catalyst.net.nz>
   * BUG 16092: Compilers may ignore overflow checks - Fix tautological-compare
     warnings

o  Stefan Metzmacher <metze@samba.org>
   * BUG 14638: restrict anonymous = 2 breaks RODC functionality
   * BUG 15973: smbpasswd can crash winbindd on an AD DC
   * BUG 15995: smbd does not cleanup on disconnect of the transport connection
     on lease break errors
   * BUG 16067: Require NTLMv2 session security on Windows makes trusts to Samba
     unusable
   * BUG 16092: Compilers may ignore overflow checks - Fix tautological-compare
     warnings

o  Andreas Schneider <asn@samba.org>
   * BUG 15987: Winbind lsa_OpenPolicy() fails on lsa connection setup with:
     NT_STATUS_RPC_CANNOT_SUPPORT

o  Shachar Sharon <ssharon@redhat.com>
   * BUG 16068: CTDB read-only record handling contains use after free and
     resource leak bugs
Comment 1 Henrik Tunedal 2026-07-29 12:11:10 UTC
There's now a 4.23.10 release with additional security fixes:
https://www.samba.org/samba/history/samba-4.23.10.html
Comment 2 Jordan Ostreff 2026-08-02 12:03:33 UTC
Created attachment 273397 [details]
net/samba423 4.23.10 upgrade depends on lmdb

o CVE-2026-6949:   TSIG packet with name compression can crash DNS

                   Incorrect size calculations when a TSIG record contains
                   compressed names can lead to a large out-of-bounds write
                   causing the server to crash.

                   https://www.samba.org/samba/security/CVE-2026-6949.html


o CVE-2026-58216:  An authenticated user could possibly crash a KDC process

                   A kpasswd packet that contains malformed ASN.1 might cause
                   the server to access 6 bytes of unallocated memory. This
                   memory is not exposed to the user, but in some
                   circumstances the server could crash.

                   https://www.samba.org/samba/security/CVE-2026-58216.html


o CVE-2026-58218:  DNS signing DoS via TKEY name cache exhaustion

                   An unauthenticated user can repeatedly register names TKEY
                   names, which floods a cache causing legitimate TKEYs to be
                   expunged. This can practically block the use DNS TSIG
                   signing.

                   https://www.samba.org/samba/security/CVE-2026-58218.html


o CVE-2026-58221:  Samba AD authenticated LDAP access domain takeover

                   Samba AD low-privilege authenticated LDAP access allows
                   modifications to internal LDB special DNs, which permits a
                   domain takeover.

                   https://www.samba.org/samba/security/CVE-2026-58221.html


o CVE-2026-58222:  Samba AD LDAP Compare filter injection and trusted-request
                   confusion disclose protected attributes

                   An ordinary authenticated domain user can bypass access
                   checks and query confidential Active Directory attributes
                   (such as KDS root keys) via LDAP Compare requests. Due to a
                   filter injection flaw and trusted execution context, the
                   LDAP Compare operation can be turned into a
                   protected-attribute disclosure oracle.

                   https://www.samba.org/samba/security/CVE-2026-58222.html


o CVE-2026-58224   The CTDB protocol has bounds checking issues

                   CTDB fails to do integrity checking of received packets.
                   This includes failure to check field lengths against packet
                   lengths when unmarshalling packets.

                   https://www.samba.org/samba/security/CVE-2026-58224.html
Comment 3 ml 2026-08-04 14:30:03 UTC
Meanwhile 4.23.11 is out, altough it's not a security release.
Comment 4 Jordan Ostreff 2026-08-04 18:53:47 UTC
Created attachment 273462 [details]
net/samba423 4.23.11 upgrade depends on lmdb

updated
Comment 5 Jordan Ostreff 2026-08-05 13:06:31 UTC
4.23.10 fixes following CVEs
CVE-2026-6949, CVE-2026-58216, CVE-2026-58218, CVE-2026-58221, CVE-2026-58222 and CVE-2026-58224.
4.23.11 is general improvement over them.
Comment 6 Xavier Beaudouin freebsd_committer freebsd_triage 2026-08-07 03:23:43 UTC
take
Comment 7 Xavier Beaudouin freebsd_committer freebsd_triage 2026-08-07 06:51:31 UTC
Thanks commited !
Comment 8 commit-hook freebsd_committer freebsd_triage 2026-08-07 06:51:47 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=38e998133ef3bbf5e7b45492af852b16dec88f44

commit 38e998133ef3bbf5e7b45492af852b16dec88f44
Author:     Jordan Ostreff <jordan@ostreff.info>
AuthorDate: 2026-08-07 06:47:07 +0000
Commit:     Xavier Beaudouin <kiwi@FreeBSD.org>
CommitDate: 2026-08-07 06:50:53 +0000

    net/samba423: update to 4.23.11

    Changelog https://www.samba.org/samba/history/samba-4.23.11.html

    Change dependency to lmdb0

    PR:     297043
    Reported by:    Jordan Ostreff
    Approved by:    samba (kiwi)

 net/samba423/Makefile | 5 ++---
 net/samba423/distinfo | 6 +++---
 2 files changed, 5 insertions(+), 6 deletions(-)