New SAMBA+ 4.15.5, 4.14.12 and 4.13.17 packages have just been released by SerNet. These are important security releases, please update affected systems as soon as possible. The packages are available for various SUSE and Red Hat platforms as well as for Debian GNU/Linux, Ubuntu and AIX.
The packages address the following issues:
- CVE-2021-44141: Information leak via symlinks of existence of files or directories outside of the exported share.
- CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution.
- CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services.
Details are listed in the respective release notes for Samba 4.15.5, 4.14.12 and 4.13.17.
SAMBA+ packages are available as software subscription. They can be purchased at the SAMBA+ shop, detailed information and prices are listed at https://shop.samba.plus. The subscriptions are managed at our platform OPOSSO (https://oposso.samba.plus). Users can activate their subscriptions here and manage access credentials. The new SAMBA+ packages are included in existing subscriptions.
