CVE-2022-1615

In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.(CVE-2022-1615)

In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version: samba (4.17.5). (BZ#2131993)

Security Fix(es):

• samba: GnuTLS gnutls_rnd() can fail and give predictable random values (CVE-2022-1615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version: samba (4.17.5). (BZ#2132051)

Security Fix(es):

• samba: GnuTLS gnutls_rnd() can fail and give predictable random values (CVE-2022-1615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2022-1615: util/genrand: don't ignore errors in random number generation

• CVE-2022-1615: util/genrand: don't ignore errors in random number generation

• Rebase onto RHEL samba-4.14.5-9.el8_5: CVE-2021-44142, the CVE-2020-25717 username map script regression, the domain-join segfault and the dangling symlink directory deletion fixes are now provided by the base.
• Re-apply TuxCare ELS security backports on the new base:
• CVE-2022-32742: fix server memory information leak via SMB1
• CVE-2022-38023: avoid weak rc4-hmac encryption algorithm for the Netlogon RPC
• CVE-2022-1615: util/genrand: don't ignore errors in random number generation
• CVE-2022-2127: fix out-of-bounds read triggered by a malicious request
• CVE-2023-34966: fix infinite loop vulnerability in mdssvc RPC service
• CVE-2023-3961: fix a path traversal out of the socket directory
• CVE-2023-4091: fix file truncation issue in acl_xattr module
• CVE-2023-34967: fix type confusion vulnerability in mdssvc RPC service
• CVE-2023-34968: fix path disclosure vulnerability in mdssvc
• CVE-2023-42669: disable the rpcecho server
• CVE-2026-4480: escape shell metacharacters in the client-controlled print job name before substituting it into "print command" via %J

In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.

This update for samba fixes the following issues:

• CVE-2022-1615: Fixed error handling in random number generation (bso#15103)(bsc#1202976).
• CVE-2022-32743: Implement validated dnsHostName write rights (bso#14833)(bsc#1202803).

Bugfixes:

• Fixed use after free when iterating smbd_server_connection->connections after tree disconnect failure (bso#15128)(bsc#1200102).

This update for samba fixes the following issues:

• CVE-2022-1615: Fixed error handling in random number generation (bso#15103)(bsc#1202976).

Bugfixes:

• Fixed use after free when iterating smbd_server_connection->connections after tree disconnect failure (bso#15128)(bsc#1200102).

This update for samba fixes the following issues:

• CVE-2022-1615: Fixed error handling in random number generation (bso#15103)(bsc#1202976).
• CVE-2022-32743: Implement validated dnsHostName write rights (bso#14833)(bsc#1202803).

Bugfixes:

• Fixed use after free when iterating smbd_server_connection->connections after tree disconnect failure (bso#15128)(bsc#1200102).

This update for samba fixes the following issues:

• CVE-2022-1615: Fixed error handling in random number generation (bso#15103)(bsc#1202976).