samba - Debian Package Tracker

general

source: samba (main)
version: 2:4.23.1+dfsg-1
maintainer: Debian Samba Maintainers (archive) (DMD)
uploaders: Mathieu Parent [DMD] – Michael Tokarev [DMD] – Jelmer Vernooĳ [DMD]
arch: all any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2:4.13.13+dfsg-1~deb11u6
o-o-sec: 2:4.13.13+dfsg-1~deb11u6
oldstable: 2:4.17.12+dfsg-0+deb12u2
old-sec: 2:4.17.12+dfsg-0+deb12u1
old-bpo: 2:4.22.4+dfsg-1~deb13u1~bpo12+1
old-upd: 2:4.17.12+dfsg-0+deb12u2
stable: 2:4.22.4+dfsg-1~deb13u1
testing: 2:4.23.1+dfsg-1
unstable: 2:4.23.1+dfsg-1

versioned links

2:4.13.13+dfsg-1~deb11u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.17.12+dfsg-0+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.17.12+dfsg-0+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.22.4+dfsg-1~deb13u1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.22.4+dfsg-1~deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.23.1+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

ctdb
ldb-tools
libldb-dev
libldb2
libnss-winbind
libpam-winbind (1 bugs: 0, 0, 1, 0)
libsmbclient
libsmbclient-dev (1 bugs: 0, 0, 1, 0)
libsmbclient0
libtalloc-dev
libtalloc2
libtdb-dev
libtdb1
libtevent-dev
libtevent0
libtevent0t64
libwbclient-dev
libwbclient0
python3-ldb
python3-samba
python3-talloc
python3-tdb
registry-tools
samba (31 bugs: 0, 25, 6, 0)
samba-ad-dc
samba-ad-provision
samba-common
samba-common-bin (3 bugs: 0, 1, 2, 0)
samba-dev
samba-dsdb-modules
samba-libs
samba-testsuite
samba-vfs-ceph
samba-vfs-glusterfs
samba-vfs-modules
smbclient (8 bugs: 0, 6, 2, 0)
tdb-tools
winbind (4 bugs: 0, 4, 0, 0)

action needed

3 security issues in bookworm high

There are 3 open security issues in bookworm.

2 important issues:

CVE-2025-9640:
CVE-2025-10230:

1 issue left for the package maintainer to handle:

CVE-2018-14628: (postponed; to be fixed through a stable update) An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.

You can find information about how to handle this issue in the security team's documentation.

Created: 2023-06-10 Last update: 2025-10-15 14:30

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2025-9640:
CVE-2025-10230:

Created: 2025-10-15 Last update: 2025-10-15 14:30

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2025-9640:
CVE-2025-10230:

Created: 2025-10-15 Last update: 2025-10-15 14:30

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2025-9640:
CVE-2025-10230:

Created: 2025-10-15 Last update: 2025-10-15 14:30

21 security issues in bullseye high

There are 21 open security issues in bullseye.

1 important issue:

CVE-2025-9640:

20 ignored issues:

CVE-2021-3670: MaxQueryDuration not honoured in Samba AD DC LDAP
CVE-2022-1615: In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.
CVE-2023-0225: A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory.
CVE-2023-0614: The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.
CVE-2023-0922: The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.
CVE-2023-4154: A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.
CVE-2018-14628: An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
CVE-2020-25720: A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.
CVE-2021-20251: A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met.
CVE-2021-20316: A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.
CVE-2021-44141: All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.
CVE-2022-32743: Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it.
CVE-2022-37966: Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
CVE-2022-37967: Windows Kerberos Elevation of Privilege Vulnerability
CVE-2022-38023: Netlogon RPC Elevation of Privilege Vulnerability
CVE-2022-42898: PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."
CVE-2022-44640: Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).
CVE-2022-45141: Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).
CVE-2023-42669: A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task.
CVE-2025-10230:

Created: 2025-10-15 Last update: 2025-10-15 14:30

debian/patches: 2 patches with invalid metadata, 8 patches to forward upstream high

Among the 26 debian patches available in version 2:4.23.1+dfsg-1 of the package, we noticed the following issues:

2 patches with invalid metadata that ought to be fixed.
8 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-09-27 15:00

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2025-01-06 Last update: 2025-10-15 18:31

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2:4.23.2+dfsg-1, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Created: 2025-10-15 Last update: 2025-10-15 18:02

lintian reports 19 warnings normal

Lintian reports 19 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-09-27 Last update: 2025-09-27 16:32

testing migrations

This package will soon be part of the auto-gpgme1.0 transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2025-10-15] Accepted samba 2:4.23.2+dfsg-1 (source) into unstable (Michael Tokarev)
[2025-09-29] samba 2:4.23.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-09-26] Accepted samba 2:4.23.1+dfsg-1 (source) into unstable (Michael Tokarev)
[2025-09-19] samba 2:4.23.0+dfsg-3 MIGRATED to testing (Debian testing watch)
[2025-09-17] samba 2:4.23.0+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-09-16] Accepted samba 2:4.22.4+dfsg-1~deb13u1~bpo12+1 (source) into oldstable-backports (Michael Tokarev)
[2025-09-16] Accepted samba 2:4.23.0+dfsg-3 (source) into unstable (Michael Tokarev)
[2025-09-14] Accepted samba 2:4.23.0+dfsg-2 (source) into unstable (Michael Tokarev)
[2025-09-12] Accepted samba 2:4.23.0+dfsg-1 (source) into unstable (Michael Tokarev)
[2025-08-29] Accepted samba 2:4.23.0~rc3+dfsg-1 (source) into experimental (Michael Tokarev)
[2025-08-25] Accepted samba 2:4.22.4+dfsg-1~deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Michael Tokarev)
[2025-08-25] samba 2:4.22.4+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-08-22] Accepted samba 2:4.23.0~rc2+dfsg-1 (source) into experimental (Michael Tokarev)
[2025-08-21] Accepted samba 2:4.22.4+dfsg-1 (source) into unstable (Michael Tokarev)
[2025-08-07] Accepted samba 2:4.23.0~rc1+dfsg-1 (source) into experimental (Michael Tokarev)
[2025-07-28] samba 2:4.22.3+dfsg-4 MIGRATED to testing (Debian testing watch)
[2025-07-27] Accepted samba 2:4.22.3+dfsg-4~bpo12+1 (source) into stable-backports (Michael Tokarev)
[2025-07-17] Accepted samba 2:4.22.3+dfsg-4 (source) into unstable (Michael Tokarev)
[2025-07-15] Accepted samba 2:4.22.3+dfsg-3 (source) into unstable (Michael Tokarev)
[2025-07-15] samba 2:4.22.3+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-07-13] Accepted samba 2:4.22.3+dfsg-2~bpo12+1 (source) into stable-backports (Michael Tokarev)
[2025-07-11] Accepted samba 2:4.17.12+dfsg-0+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Michael Tokarev)
[2025-07-09] Accepted samba 2:4.22.3+dfsg-2 (source) into unstable (Michael Tokarev)
[2025-07-07] Accepted samba 2:4.22.3+dfsg-1 (source) into unstable (Michael Tokarev)
[2025-06-11] samba 2:4.22.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-06-10] Accepted samba 2:4.22.2+dfsg-1~bpo12+1 (source) into stable-backports (Michael Tokarev)
[2025-06-05] Accepted samba 2:4.22.2+dfsg-1 (source) into unstable (Michael Tokarev)
[2025-05-13] Accepted samba 2:4.22.1+dfsg-1~bpo12+1 (source) into stable-backports (Michael Tokarev)
[2025-04-29] samba 2:4.22.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-04-18] Accepted samba 2:4.22.1+dfsg-1 (source) into unstable (Michael Tokarev)

bugs [bug history graph]

all: 53
RC: 0
I&N: 38
M&W: 14
F&P: 1
patch: 2

links

homepage
lintian (0, 19)
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
l10n (-, 35)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2:4.22.3+dfsg-4ubuntu2
348 bugs (7 patches)
patches for 2:4.22.3+dfsg-4ubuntu2