SAMBA+ 4.17.4, 4.16.8 and 4.15.13 Security Releases Available

SAMBA+ 4.17.4, 4.16.8 and 4.15.13 have just been released. These are important security releases, please update affected systems as soon as possible. The packages are available for various SUSE and Red Hat platforms as well as for Debian GNU/Linux, Ubuntu and AIX.

Please note that there are several important behavior changes included in this releases, which may cause compatibility problems interacting with system still expecting the former behavior. Especially systems older than Windows 7, Windows 2008R2 and Samba 4.0 are affected here. Systems like NetApp ONTAP may also be affected. Please read the release notes and advisories carefully:

The packages address the following security related issues:

  • CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers
    This is the Samba CVE for the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability disclosed by Microsoft on Nov 8 2022.

    A Samba Active Directory DC will issue weak rc4-hmac session keys for use between modern clients and servers despite all modern Kerberos implementations supporting the aes256-cts-hmac-sha1-96 cipher.

    On Samba Active Directory DCs and members 'kerberos encryption types = legacy' would force rc4-hmac as a client even if the server supports aes128-cts-hmac-sha1-96 and/or aes256-cts-hmac-sha1-96.
  • CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC
    This is the Samba CVE for the Windows Kerberos Elevation of Privilege Vulnerability disclosed by Microsoft on Nov 8 2022.

    A service account with the special constrained delegation permission could forge a more powerful ticket than the one it was presented with.
  • CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided
    The "RC4" protection of the NetLogon Secure channel uses the same algorithms as rc4-hmac cryptography in Kerberos, and so must also be assumed to be weak.

The SAMBA+ 4.15.13 packages additionally addresses:

  • CVE-2022-45141 Samba AD DC using Heimdal can be forced to issue rc4-hmac encrypted Kerberos tickets
    Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak.

    Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (e.g. aes256-cts-hmac-sha1-96).


SerNet's Samba newsletter informs you about all important developments and events with its main focus on new packages.

+ subscribe to Newsletter

RSS Feed

Don't miss any more SAMBA+ news? Read the latest in your feed reader of choice.

+ subscribe to RSS feed


Buy software subscriptions and support budgets. SAMBA+ subscriptions are available for 1, 2 and 3 years at the SAMBA+ shop.

+ visit the US Shop ($)

+ visit the World Shop (€)

Contact us

We are here for you!

Our sales team is happy to help you with any questions about all Samba products and services from SerNet - personally and individually tailored to your needs.

You can call us directly at +1 (415) 248-7818
or outside the US at +49 551 370000-0.
Mail us at

Contact us!

linke Spalte
rechte Splate
* Mandatory Fields
Deutsch English Français