samba - Debian Package Tracker

general

source: samba (main)
version: 2:4.24.3+dfsg-1
maintainer: Debian Samba Maintainers (archive) (DMD)
uploaders: Michael Tokarev [DMD] – Mathieu Parent [DMD] – Jelmer Vernooĳ [DMD]
arch: all any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2:4.13.13+dfsg-1~deb11u6
o-o-sec: 2:4.13.13+dfsg-1~deb11u7
oldstable: 2:4.17.12+dfsg-0+deb12u3
old-sec: 2:4.17.12+dfsg-0+deb12u4
old-bpo: 2:4.22.6+dfsg-0+deb13u1~bpo12+1
old-upd: 2:4.17.12+dfsg-0+deb12u2
old-p-u: 2:4.17.12+dfsg-0+deb12u4
stable: 2:4.22.8+dfsg-0+deb13u1
stable-sec: 2:4.22.8+dfsg-0+deb13u2
stable-bpo: 2:4.24.3+dfsg-1~bpo13+1
stable-p-u: 2:4.22.8+dfsg-0+deb13u2
testing: 2:4.24.3+dfsg-1
unstable: 2:4.24.3+dfsg-1

versioned links

2:4.13.13+dfsg-1~deb11u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.13.13+dfsg-1~deb11u7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.17.12+dfsg-0+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.17.12+dfsg-0+deb12u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.17.12+dfsg-0+deb12u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.22.6+dfsg-0+deb13u1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.22.8+dfsg-0+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.22.8+dfsg-0+deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.24.3+dfsg-1~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.24.3+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

ctdb
ldb-tools
libldb-dev
libldb2
libnss-winbind
libpam-winbind (1 bugs: 0, 0, 1, 0)
libsmbclient
libsmbclient-dev (1 bugs: 0, 0, 1, 0)
libsmbclient0
libtalloc-dev
libtalloc2
libtdb-dev
libtdb1
libtevent-dev
libtevent0
libtevent0t64
libwbclient-dev
libwbclient0
python3-ldb
python3-samba
python3-talloc
python3-tdb
registry-tools
samba (32 bugs: 0, 25, 7, 0)
samba-ad-dc
samba-ad-provision
samba-common
samba-common-bin (3 bugs: 0, 1, 2, 0)
samba-dev
samba-dsdb-modules
samba-libs
samba-testsuite
samba-vfs-ceph
samba-vfs-glusterfs
samba-vfs-modules
smbclient (8 bugs: 0, 6, 2, 0)
tdb-tools
winbind (4 bugs: 0, 4, 0, 0)

action needed

25 security issues in bullseye high

There are 25 open security issues in bullseye.

5 important issues:

CVE-2026-2340: A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.
CVE-2026-3012: A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.
CVE-2026-3238: A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.
CVE-2026-4408: A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
CVE-2026-4480: A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.

20 ignored issues:

CVE-2021-3670: MaxQueryDuration not honoured in Samba AD DC LDAP
CVE-2022-1615: In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.
CVE-2023-0225: A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory.
CVE-2023-0614: The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.
CVE-2023-0922: The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.
CVE-2023-4154: A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.
CVE-2018-14628: An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
CVE-2020-25720: A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.
CVE-2021-20251: A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met.
CVE-2021-20316: A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.
CVE-2021-44141: All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.
CVE-2022-32743: Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it.
CVE-2022-37966: Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
CVE-2022-37967: Windows Kerberos Elevation of Privilege Vulnerability
CVE-2022-38023: Netlogon RPC Elevation of Privilege Vulnerability
CVE-2022-42898: PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."
CVE-2022-44640: Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).
CVE-2022-45141: Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).
CVE-2023-42669: A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task.
CVE-2025-10230: A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.

Created: 2026-05-26 Last update: 2026-06-09 04:31

debian/patches: 1 patch with invalid metadata, 9 patches to forward upstream high

Among the 28 debian patches available in version 2:4.24.3+dfsg-1 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.
9 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-05-26 20:01

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2026-06-02 Last update: 2026-06-26 22:30

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit feebc8fca75b1a1084188f29048138ee8acea9f2
Merge: 7effbabd 15240170
Author: Michael Tokarev <mjt@debian.org>
Date:   Fri Jun 26 08:34:49 2026 +0300

    Merge branch 'hurd-heimdal' into 'master'
    
    fix build on Hurd using fix from upstream heimdal
    
    See merge request samba-team/samba!71

commit 15240170068dc72c28f44784d88877d18a950ccc
Author: Pino Toscano <pino@debian.org>
Date:   Sun Jun 7 06:46:09 2026 +0200

    heimdal-errno-include.patch
    
    fix build on Hurd using fix from upstream heimdal

Created: 2026-06-26 Last update: 2026-06-26 06:50

lintian reports 17 warnings normal

Lintian reports 17 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-05-27 Last update: 2026-05-27 21:01

Multiarch hinter reports 1 issue(s) low

There are issues with the multiarch metadata for this package.

samba-vfs-modules could be converted to Architecture: all and marked Multi-Arch: foreign

Created: 2026-05-27 Last update: 2026-06-26 22:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-05-26 16:32

news

[rss feed]

[2026-05-30] samba 2:4.24.3+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-05-26] Accepted samba 2:4.17.12+dfsg-0+deb12u4 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Michael Tokarev)
[2026-05-26] Accepted samba 2:4.22.8+dfsg-0+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Michael Tokarev)
[2026-05-26] Accepted samba 2:4.22.8+dfsg-0+deb13u2 (source) into stable-security (Debian FTP Masters) (signed by: Michael Tokarev)
[2026-05-26] Accepted samba 2:4.17.12+dfsg-0+deb12u4 (source) into oldstable-security (Debian FTP Masters) (signed by: Michael Tokarev)
[2026-05-26] Accepted samba 2:4.24.3+dfsg-1~bpo13+1 (source) into stable-backports (Michael Tokarev)
[2026-05-26] Accepted samba 2:4.24.3+dfsg-1 (source) into unstable (Michael Tokarev)
[2026-05-24] samba 2:4.24.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-05-23] Accepted samba 2:4.24.2+dfsg-1~bpo13+1 (source) into stable-backports (Michael Tokarev)
[2026-05-12] Accepted samba 2:4.24.2+dfsg-1 (source) into unstable (Michael Tokarev)
[2026-04-22] samba 2:4.24.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-04-17] Accepted samba 2:4.24.1+dfsg-1 (source) into unstable (Michael Tokarev)
[2026-03-18] Accepted samba 2:4.24.0+dfsg-1 (source) into experimental (Michael Tokarev)
[2026-03-15] samba 2:4.23.6+dfsg-2 MIGRATED to testing (Debian testing watch)
[2026-03-11] Accepted samba 2:4.23.6+dfsg-2~bpo13+1 (source) into stable-backports (Michael Tokarev)
[2026-03-08] Accepted samba 2:4.23.6+dfsg-2 (source) into unstable (Michael Tokarev)
[2026-03-07] Accepted samba 2:4.22.8+dfsg-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Michael Tokarev)
[2026-03-01] samba 2:4.23.6+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-02-27] Accepted samba 2:4.23.6+dfsg-1 (source) into unstable (Michael Tokarev)
[2026-02-07] Accepted samba 2:4.24.0~rc2+dfsg-1 (source) into experimental (Michael Tokarev)
[2026-01-26] Accepted samba 2:4.23.5+dfsg-1~bpo13+1 (source) into stable-backports (Michael Tokarev)
[2026-01-26] samba 2:4.23.5+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-01-24] Accepted samba 2:4.23.5+dfsg-1 (source) into unstable (Michael Tokarev)
[2026-01-21] Accepted samba 2:4.24.0~rc1+dfsg-3 (source) into experimental (Michael Tokarev)
[2026-01-20] Accepted samba 2:4.24.0~rc1+dfsg-2 (source) into experimental (Michael Tokarev)
[2026-01-20] Accepted samba 2:4.24.0~rc1+dfsg-1 (source) into experimental (Michael Tokarev)
[2025-12-17] Accepted samba 2:4.23.4+dfsg-1~bpo13+1 (source) into stable-backports (Michael Tokarev)
[2025-12-16] samba 2:4.23.4+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-12-12] Accepted samba 2:4.23.4+dfsg-1 (source) into unstable (Michael Tokarev)
[2025-12-07] Accepted samba 2:4.17.12+dfsg-0+deb12u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Michael Tokarev)

bugs [bug history graph]

all: 55
RC: 0
I&N: 39
M&W: 15
F&P: 1
patch: 2

links

homepage
lintian (0, 17)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (-, 46)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2:4.23.6+dfsg-1ubuntu2