!210 fix CVE-2022-2127 CVE-2023-34966 CVE-2023-34967
From: @xinghe_1 Reviewed-by: @kircher Signed-off-by: @kircher
This commit is contained in:
openeuler-ci-bot
Gitee
commit
3e3df83262
69
backport-0001-CVE-2022-2127.patch
Normal file
69
backport-0001-CVE-2022-2127.patch
Normal file
@ -0,0 +1,69 @@
|
|||||||
|
From 1dd3ae281b9d9260859822bbf6891e94c2f86882 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Samuel Cabrero <scabrero@samba.org>
|
||||||
|
Date: Thu, 24 Feb 2022 17:48:27 +0100
|
||||||
|
Subject: [PATCH 01/25] CVE-2022-2127: s3:winbind: Move big NTLMv2 blob checks
|
||||||
|
to parent process
|
||||||
|
|
||||||
|
The winbindd_dual_pam_auth_crap() function will be converted to a local
|
||||||
|
RPC call handler and it won't receive a winbindd_cli_state struct. Move
|
||||||
|
the checks accessing this struct to the parent.
|
||||||
|
|
||||||
|
Signed-off-by: Samuel Cabrero <scabrero@samba.org>
|
||||||
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
||||||
|
(cherry picked from commit 74a511a8eab72cc82940738a1e20e63e12b81374)
|
||||||
|
|
||||||
|
Conflict: NA
|
||||||
|
Reference: https://download.samba.org/pub/samba/patches/security/samba-4.16.11-security-2023-07-19.patch
|
||||||
|
---
|
||||||
|
source3/winbindd/winbindd_pam.c | 12 ------------
|
||||||
|
source3/winbindd/winbindd_pam_auth_crap.c | 12 ++++++++++++
|
||||||
|
2 files changed, 12 insertions(+), 12 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/source3/winbindd/winbindd_pam.c b/source3/winbindd/winbindd_pam.c
|
||||||
|
index e600ad27e54..e77673bf173 100644
|
||||||
|
--- a/source3/winbindd/winbindd_pam.c
|
||||||
|
+++ b/source3/winbindd/winbindd_pam.c
|
||||||
|
@@ -2671,18 +2671,6 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
|
||||||
|
DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
|
||||||
|
name_domain, name_user));
|
||||||
|
|
||||||
|
- if (state->request->data.auth_crap.lm_resp_len > sizeof(state->request->data.auth_crap.lm_resp)
|
||||||
|
- || state->request->data.auth_crap.nt_resp_len > sizeof(state->request->data.auth_crap.nt_resp)) {
|
||||||
|
- if (!(state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) ||
|
||||||
|
- state->request->extra_len != state->request->data.auth_crap.nt_resp_len) {
|
||||||
|
- DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
|
||||||
|
- state->request->data.auth_crap.lm_resp_len,
|
||||||
|
- state->request->data.auth_crap.nt_resp_len));
|
||||||
|
- result = NT_STATUS_INVALID_PARAMETER;
|
||||||
|
- goto done;
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
lm_resp = data_blob_talloc(state->mem_ctx, state->request->data.auth_crap.lm_resp,
|
||||||
|
state->request->data.auth_crap.lm_resp_len);
|
||||||
|
|
||||||
|
diff --git a/source3/winbindd/winbindd_pam_auth_crap.c b/source3/winbindd/winbindd_pam_auth_crap.c
|
||||||
|
index a6f13806df9..fdb8120a6fe 100644
|
||||||
|
--- a/source3/winbindd/winbindd_pam_auth_crap.c
|
||||||
|
+++ b/source3/winbindd/winbindd_pam_auth_crap.c
|
||||||
|
@@ -140,6 +140,18 @@ struct tevent_req *winbindd_pam_auth_crap_send(
|
||||||
|
fstrcpy(request->data.auth_crap.workstation, lp_netbios_name());
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (request->data.auth_crap.lm_resp_len > sizeof(request->data.auth_crap.lm_resp)
|
||||||
|
+ || request->data.auth_crap.nt_resp_len > sizeof(request->data.auth_crap.nt_resp)) {
|
||||||
|
+ if (!(request->flags & WBFLAG_BIG_NTLMV2_BLOB) ||
|
||||||
|
+ request->extra_len != request->data.auth_crap.nt_resp_len) {
|
||||||
|
+ DBG_ERR("Invalid password length %u/%u\n",
|
||||||
|
+ request->data.auth_crap.lm_resp_len,
|
||||||
|
+ request->data.auth_crap.nt_resp_len);
|
||||||
|
+ tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
||||||
|
+ return tevent_req_post(req, ev);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
subreq = wb_domain_request_send(state, global_event_context(), domain,
|
||||||
|
request);
|
||||||
|
if (tevent_req_nomem(subreq, req)) {
|
||||||
|
--
|
||||||
|
2.34.1
|
||||||
73
backport-0002-CVE-2022-2127.patch
Normal file
73
backport-0002-CVE-2022-2127.patch
Normal file
@ -0,0 +1,73 @@
|
|||||||
|
From 5c6fe5a491b16bb658c191cfafb5edc0beb5fab2 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Volker Lendecke <vl@samba.org>
|
||||||
|
Date: Fri, 20 May 2022 10:55:23 +0200
|
||||||
|
Subject: [PATCH 02/25] CVE-2022-2127: winbindd: Fix WINBINDD_PAM_AUTH_CRAP
|
||||||
|
length checks
|
||||||
|
|
||||||
|
With WBFLAG_BIG_NTLMV2_BLOB being set plus lm_resp_len too large you
|
||||||
|
can crash winbind. We don't independently check lm_resp_len
|
||||||
|
sufficiently.
|
||||||
|
|
||||||
|
Discovered via Coverity ID 1504444 Out-of-bounds access
|
||||||
|
|
||||||
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15072
|
||||||
|
|
||||||
|
Signed-off-by: Volker Lendecke <vl@samba.org>
|
||||||
|
|
||||||
|
Conflict: NA
|
||||||
|
Reference: https://download.samba.org/pub/samba/patches/security/samba-4.16.11-security-2023-07-19.patch
|
||||||
|
---
|
||||||
|
source3/winbindd/winbindd_pam_auth_crap.c | 31 +++++++++++++++--------
|
||||||
|
1 file changed, 21 insertions(+), 10 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/source3/winbindd/winbindd_pam_auth_crap.c b/source3/winbindd/winbindd_pam_auth_crap.c
|
||||||
|
index fdb8120a6fe..651d54b01d3 100644
|
||||||
|
--- a/source3/winbindd/winbindd_pam_auth_crap.c
|
||||||
|
+++ b/source3/winbindd/winbindd_pam_auth_crap.c
|
||||||
|
@@ -42,6 +42,9 @@ struct tevent_req *winbindd_pam_auth_crap_send(
|
||||||
|
struct winbindd_pam_auth_crap_state *state;
|
||||||
|
struct winbindd_domain *domain;
|
||||||
|
const char *auth_domain = NULL;
|
||||||
|
+ bool lmlength_ok = false;
|
||||||
|
+ bool ntlength_ok = false;
|
||||||
|
+ bool pwlength_ok = false;
|
||||||
|
|
||||||
|
req = tevent_req_create(mem_ctx, &state,
|
||||||
|
struct winbindd_pam_auth_crap_state);
|
||||||
|
@@ -140,16 +143,24 @@ struct tevent_req *winbindd_pam_auth_crap_send(
|
||||||
|
fstrcpy(request->data.auth_crap.workstation, lp_netbios_name());
|
||||||
|
}
|
||||||
|
|
||||||
|
- if (request->data.auth_crap.lm_resp_len > sizeof(request->data.auth_crap.lm_resp)
|
||||||
|
- || request->data.auth_crap.nt_resp_len > sizeof(request->data.auth_crap.nt_resp)) {
|
||||||
|
- if (!(request->flags & WBFLAG_BIG_NTLMV2_BLOB) ||
|
||||||
|
- request->extra_len != request->data.auth_crap.nt_resp_len) {
|
||||||
|
- DBG_ERR("Invalid password length %u/%u\n",
|
||||||
|
- request->data.auth_crap.lm_resp_len,
|
||||||
|
- request->data.auth_crap.nt_resp_len);
|
||||||
|
- tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
||||||
|
- return tevent_req_post(req, ev);
|
||||||
|
- }
|
||||||
|
+ lmlength_ok = (request->data.auth_crap.lm_resp_len <=
|
||||||
|
+ sizeof(request->data.auth_crap.lm_resp));
|
||||||
|
+
|
||||||
|
+ ntlength_ok = (request->data.auth_crap.nt_resp_len <=
|
||||||
|
+ sizeof(request->data.auth_crap.nt_resp));
|
||||||
|
+
|
||||||
|
+ ntlength_ok |=
|
||||||
|
+ ((request->flags & WBFLAG_BIG_NTLMV2_BLOB) &&
|
||||||
|
+ (request->extra_len == request->data.auth_crap.nt_resp_len));
|
||||||
|
+
|
||||||
|
+ pwlength_ok = lmlength_ok && ntlength_ok;
|
||||||
|
+
|
||||||
|
+ if (!pwlength_ok) {
|
||||||
|
+ DBG_ERR("Invalid password length %u/%u\n",
|
||||||
|
+ request->data.auth_crap.lm_resp_len,
|
||||||
|
+ request->data.auth_crap.nt_resp_len);
|
||||||
|
+ tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
||||||
|
+ return tevent_req_post(req, ev);
|
||||||
|
}
|
||||||
|
|
||||||
|
subreq = wb_domain_request_send(state, global_event_context(), domain,
|
||||||
|
--
|
||||||
|
2.34.1
|
||||||
43
backport-0003-CVE-2022-2127.patch
Normal file
43
backport-0003-CVE-2022-2127.patch
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
From 2eabbe31f64a8456813a502afb05907beb46ffad Mon Sep 17 00:00:00 2001
|
||||||
|
From: Ralph Boehme <slow@samba.org>
|
||||||
|
Date: Fri, 16 Jun 2023 12:28:47 +0200
|
||||||
|
Subject: [PATCH 03/25] CVE-2022-2127: ntlm_auth: cap lanman response length
|
||||||
|
value
|
||||||
|
|
||||||
|
We already copy at most sizeof(request.data.auth_crap.lm_resp) bytes to the
|
||||||
|
lm_resp buffer, but we don't cap the length indicator.
|
||||||
|
|
||||||
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15072
|
||||||
|
|
||||||
|
Signed-off-by: Ralph Boehme <slow@samba.org>
|
||||||
|
|
||||||
|
Conflict: NA
|
||||||
|
Reference: https://download.samba.org/pub/samba/patches/security/samba-4.16.11-security-2023-07-19.patch
|
||||||
|
---
|
||||||
|
source3/utils/ntlm_auth.c | 8 ++++++--
|
||||||
|
1 file changed, 6 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c
|
||||||
|
index 52a1840..f363f25 100644
|
||||||
|
--- a/source3/utils/ntlm_auth.c
|
||||||
|
+++ b/source3/utils/ntlm_auth.c
|
||||||
|
@@ -570,10 +570,14 @@ NTSTATUS contact_winbind_auth_crap(const char *username,
|
||||||
|
memcpy(request.data.auth_crap.chal, challenge->data, MIN(challenge->length, 8));
|
||||||
|
|
||||||
|
if (lm_response && lm_response->length) {
|
||||||
|
+ size_t capped_lm_response_len = MIN(
|
||||||
|
+ lm_response->length,
|
||||||
|
+ sizeof(request.data.auth_crap.lm_resp));
|
||||||
|
+
|
||||||
|
memcpy(request.data.auth_crap.lm_resp,
|
||||||
|
lm_response->data,
|
||||||
|
- MIN(lm_response->length, sizeof(request.data.auth_crap.lm_resp)));
|
||||||
|
- request.data.auth_crap.lm_resp_len = lm_response->length;
|
||||||
|
+ capped_lm_response_len);
|
||||||
|
+ request.data.auth_crap.lm_resp_len = capped_lm_response_len;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (nt_response && nt_response->length) {
|
||||||
|
--
|
||||||
|
2.27.0
|
||||||
|
|
||||||
75
backport-CVE-2023-34966.patch
Normal file
75
backport-CVE-2023-34966.patch
Normal file
@ -0,0 +1,75 @@
|
|||||||
|
From cb6f3e2202473eeccf81e34ebcdb4bc4f726548a Mon Sep 17 00:00:00 2001
|
||||||
|
From: Ralph Boehme <slow@samba.org>
|
||||||
|
Date: Fri, 26 May 2023 13:06:19 +0200
|
||||||
|
Subject: [PATCH 05/25] CVE-2023-34966: mdssvc: harden sl_unpack_loop()
|
||||||
|
|
||||||
|
A malicious client could send a packet where subcount is zero, leading to a busy
|
||||||
|
loop because
|
||||||
|
|
||||||
|
count -= subcount
|
||||||
|
=> count -= 0
|
||||||
|
=> while (count > 0)
|
||||||
|
|
||||||
|
loops forever.
|
||||||
|
|
||||||
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15340
|
||||||
|
|
||||||
|
Signed-off-by: Ralph Boehme <slow@samba.org>
|
||||||
|
|
||||||
|
Conflict: NA
|
||||||
|
Reference: https://download.samba.org/pub/samba/patches/security/samba-4.16.11-security-2023-07-19.patch
|
||||||
|
---
|
||||||
|
source3/rpc_server/mdssvc/marshalling.c | 10 +++++-----
|
||||||
|
1 file changed, 5 insertions(+), 5 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/source3/rpc_server/mdssvc/marshalling.c b/source3/rpc_server/mdssvc/marshalling.c
|
||||||
|
index 1aa750413cd..441d41160f1 100644
|
||||||
|
--- a/source3/rpc_server/mdssvc/marshalling.c
|
||||||
|
+++ b/source3/rpc_server/mdssvc/marshalling.c
|
||||||
|
@@ -1119,7 +1119,7 @@ static ssize_t sl_unpack_loop(DALLOC_CTX *query,
|
||||||
|
sl_nil_t nil = 0;
|
||||||
|
|
||||||
|
subcount = tag.count;
|
||||||
|
- if (subcount > count) {
|
||||||
|
+ if (subcount < 1 || subcount > count) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
for (i = 0; i < subcount; i++) {
|
||||||
|
@@ -1147,7 +1147,7 @@ static ssize_t sl_unpack_loop(DALLOC_CTX *query,
|
||||||
|
|
||||||
|
case SQ_TYPE_INT64:
|
||||||
|
subcount = sl_unpack_ints(query, buf, offset, bufsize, encoding);
|
||||||
|
- if (subcount == -1 || subcount > count) {
|
||||||
|
+ if (subcount < 1 || subcount > count) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
offset += tag.size;
|
||||||
|
@@ -1156,7 +1156,7 @@ static ssize_t sl_unpack_loop(DALLOC_CTX *query,
|
||||||
|
|
||||||
|
case SQ_TYPE_UUID:
|
||||||
|
subcount = sl_unpack_uuid(query, buf, offset, bufsize, encoding);
|
||||||
|
- if (subcount == -1 || subcount > count) {
|
||||||
|
+ if (subcount < 1 || subcount > count) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
offset += tag.size;
|
||||||
|
@@ -1165,7 +1165,7 @@ static ssize_t sl_unpack_loop(DALLOC_CTX *query,
|
||||||
|
|
||||||
|
case SQ_TYPE_FLOAT:
|
||||||
|
subcount = sl_unpack_floats(query, buf, offset, bufsize, encoding);
|
||||||
|
- if (subcount == -1 || subcount > count) {
|
||||||
|
+ if (subcount < 1 || subcount > count) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
offset += tag.size;
|
||||||
|
@@ -1174,7 +1174,7 @@ static ssize_t sl_unpack_loop(DALLOC_CTX *query,
|
||||||
|
|
||||||
|
case SQ_TYPE_DATE:
|
||||||
|
subcount = sl_unpack_date(query, buf, offset, bufsize, encoding);
|
||||||
|
- if (subcount == -1 || subcount > count) {
|
||||||
|
+ if (subcount < 1 || subcount > count) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
offset += tag.size;
|
||||||
|
--
|
||||||
|
2.34.1
|
||||||
123
backport-CVE-2023-34967.patch
Normal file
123
backport-CVE-2023-34967.patch
Normal file
@ -0,0 +1,123 @@
|
|||||||
|
From 5b4353cc60b75610f0aa12b1cced36d35a4d04d4 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Ralph Boehme <slow@samba.org>
|
||||||
|
Date: Fri, 26 May 2023 15:06:38 +0200
|
||||||
|
Subject: [PATCH 07/25] CVE-2023-34967: mdssvc: add type checking to
|
||||||
|
dalloc_value_for_key()
|
||||||
|
|
||||||
|
Change the dalloc_value_for_key() function to require an additional final
|
||||||
|
argument which denotes the expected type of the value associated with a key. If
|
||||||
|
the types don't match, return NULL.
|
||||||
|
|
||||||
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15341
|
||||||
|
|
||||||
|
Signed-off-by: Ralph Boehme <slow@samba.org>
|
||||||
|
|
||||||
|
Conflict: NA
|
||||||
|
Reference: https://download.samba.org/pub/samba/patches/security/samba-4.16.11-security-2023-07-19.patch
|
||||||
|
---
|
||||||
|
source3/rpc_server/mdssvc/dalloc.c | 14 ++++++++++----
|
||||||
|
source3/rpc_server/mdssvc/mdssvc.c | 17 +++++++++++++----
|
||||||
|
2 files changed, 23 insertions(+), 8 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/source3/rpc_server/mdssvc/dalloc.c b/source3/rpc_server/mdssvc/dalloc.c
|
||||||
|
index 28944b8..908d54b 100644
|
||||||
|
--- a/source3/rpc_server/mdssvc/dalloc.c
|
||||||
|
+++ b/source3/rpc_server/mdssvc/dalloc.c
|
||||||
|
@@ -160,7 +160,7 @@ void *dalloc_value_for_key(const DALLOC_CTX *d, ...)
|
||||||
|
int result = 0;
|
||||||
|
void *p = NULL;
|
||||||
|
va_list args;
|
||||||
|
- const char *type;
|
||||||
|
+ const char *type = NULL;
|
||||||
|
int elem;
|
||||||
|
size_t array_len;
|
||||||
|
|
||||||
|
@@ -171,7 +171,6 @@ void *dalloc_value_for_key(const DALLOC_CTX *d, ...)
|
||||||
|
array_len = talloc_array_length(d->dd_talloc_array);
|
||||||
|
elem = va_arg(args, int);
|
||||||
|
if (elem >= array_len) {
|
||||||
|
- va_end(args);
|
||||||
|
result = -1;
|
||||||
|
goto done;
|
||||||
|
}
|
||||||
|
@@ -179,8 +178,6 @@ void *dalloc_value_for_key(const DALLOC_CTX *d, ...)
|
||||||
|
type = va_arg(args, const char *);
|
||||||
|
}
|
||||||
|
|
||||||
|
- va_end(args);
|
||||||
|
-
|
||||||
|
array_len = talloc_array_length(d->dd_talloc_array);
|
||||||
|
|
||||||
|
for (elem = 0; elem + 1 < array_len; elem += 2) {
|
||||||
|
@@ -193,8 +190,17 @@ void *dalloc_value_for_key(const DALLOC_CTX *d, ...)
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
+ if (p == NULL) {
|
||||||
|
+ goto done;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ type = va_arg(args, const char *);
|
||||||
|
+ if (strcmp(talloc_get_name(p), type) != 0) {
|
||||||
|
+ p = NULL;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
done:
|
||||||
|
+ va_end(args);
|
||||||
|
if (result != 0) {
|
||||||
|
p = NULL;
|
||||||
|
}
|
||||||
|
diff --git a/source3/rpc_server/mdssvc/mdssvc.c b/source3/rpc_server/mdssvc/mdssvc.c
|
||||||
|
index 58a219b..dba7c3c 100644
|
||||||
|
--- a/source3/rpc_server/mdssvc/mdssvc.c
|
||||||
|
+++ b/source3/rpc_server/mdssvc/mdssvc.c
|
||||||
|
@@ -1198,7 +1198,8 @@ static bool slrpc_open_query(struct mds_ctx *mds_ctx,
|
||||||
|
|
||||||
|
querystring = dalloc_value_for_key(query, "DALLOC_CTX", 0,
|
||||||
|
"DALLOC_CTX", 1,
|
||||||
|
- "kMDQueryString");
|
||||||
|
+ "kMDQueryString",
|
||||||
|
+ "char *");
|
||||||
|
if (querystring == NULL) {
|
||||||
|
DEBUG(1, ("missing kMDQueryString\n"));
|
||||||
|
goto error;
|
||||||
|
@@ -1228,8 +1229,11 @@ static bool slrpc_open_query(struct mds_ctx *mds_ctx,
|
||||||
|
slq->ctx2 = *uint64p;
|
||||||
|
|
||||||
|
path_scope = dalloc_value_for_key(query, "DALLOC_CTX", 0,
|
||||||
|
- "DALLOC_CTX", 1, "kMDScopeArray");
|
||||||
|
+ "DALLOC_CTX", 1,
|
||||||
|
+ "kMDScopeArray",
|
||||||
|
+ "sl_array_t");
|
||||||
|
if (path_scope == NULL) {
|
||||||
|
+ DBG_ERR("missing kMDScopeArray\n");
|
||||||
|
goto error;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -1253,8 +1257,11 @@ static bool slrpc_open_query(struct mds_ctx *mds_ctx,
|
||||||
|
|
||||||
|
|
||||||
|
reqinfo = dalloc_value_for_key(query, "DALLOC_CTX", 0,
|
||||||
|
- "DALLOC_CTX", 1, "kMDAttributeArray");
|
||||||
|
+ "DALLOC_CTX", 1,
|
||||||
|
+ "kMDAttributeArray",
|
||||||
|
+ "sl_array_t");
|
||||||
|
if (reqinfo == NULL) {
|
||||||
|
+ DBG_ERR("missing kMDAttributeArray\n");
|
||||||
|
goto error;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -1262,7 +1269,9 @@ static bool slrpc_open_query(struct mds_ctx *mds_ctx,
|
||||||
|
DEBUG(10, ("requested attributes: %s", mds_dalloc_dump(reqinfo, 0)));
|
||||||
|
|
||||||
|
cnids = dalloc_value_for_key(query, "DALLOC_CTX", 0,
|
||||||
|
- "DALLOC_CTX", 1, "kMDQueryItemArray");
|
||||||
|
+ "DALLOC_CTX", 1,
|
||||||
|
+ "kMDQueryItemArray",
|
||||||
|
+ "sl_array_t");
|
||||||
|
if (cnids) {
|
||||||
|
ok = sort_cnids(slq, cnids->ca_cnids);
|
||||||
|
if (!ok) {
|
||||||
|
--
|
||||||
|
2.27.0
|
||||||
|
|
||||||
13
samba.spec
13
samba.spec
@ -49,7 +49,7 @@
|
|||||||
|
|
||||||
Name: samba
|
Name: samba
|
||||||
Version: 4.11.12
|
Version: 4.11.12
|
||||||
Release: 29
|
Release: 30
|
||||||
|
|
||||||
Summary: A suite for Linux to interoperate with Windows
|
Summary: A suite for Linux to interoperate with Windows
|
||||||
License: GPLv3+ and LGPLv3+
|
License: GPLv3+ and LGPLv3+
|
||||||
@ -340,6 +340,11 @@ Patch6410: backport-0037-CVE-2022-38023.patch
|
|||||||
Patch6411: backport-0038-CVE-2022-38023.patch
|
Patch6411: backport-0038-CVE-2022-38023.patch
|
||||||
Patch6412: backport-CVE-2023-0922.patch
|
Patch6412: backport-CVE-2023-0922.patch
|
||||||
Patch6413: backport-Adapt-sign_authdata-in-our-KDB-module-for-krb5-v1.18.patch
|
Patch6413: backport-Adapt-sign_authdata-in-our-KDB-module-for-krb5-v1.18.patch
|
||||||
|
Patch6414: backport-0001-CVE-2022-2127.patch
|
||||||
|
Patch6415: backport-0002-CVE-2022-2127.patch
|
||||||
|
Patch6416: backport-0003-CVE-2022-2127.patch
|
||||||
|
Patch6417: backport-CVE-2023-34966.patch
|
||||||
|
Patch6418: backport-CVE-2023-34967.patch
|
||||||
|
|
||||||
|
|
||||||
BuildRequires: avahi-devel cups-devel dbus-devel docbook-style-xsl e2fsprogs-devel gawk gnupg2 gnutls-devel >= 3.4.7 gpgme-devel
|
BuildRequires: avahi-devel cups-devel dbus-devel docbook-style-xsl e2fsprogs-devel gawk gnupg2 gnutls-devel >= 3.4.7 gpgme-devel
|
||||||
@ -3398,6 +3403,12 @@ fi
|
|||||||
%{_mandir}/man*
|
%{_mandir}/man*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Mon Jul 24 2023 xinghe <xinghe2@h-partners.com> - 4.11.12-30
|
||||||
|
- Type:cves
|
||||||
|
- CVE:CVE-2022-2127 CVE-2023-34966 CVE-2023-34967
|
||||||
|
- SUG:NA
|
||||||
|
- DESC:fix CVE-2022-2127 CVE-2023-34966 CVE-2023-34967
|
||||||
|
|
||||||
* Mon Jun 26 2023 yanglu <yanglu72@h-partners.com> - 4.11.12-29
|
* Mon Jun 26 2023 yanglu <yanglu72@h-partners.com> - 4.11.12-29
|
||||||
- Type:bugfix
|
- Type:bugfix
|
||||||
- CVE:NA
|
- CVE:NA
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user