Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-14907: All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless). 1791207: CVE-2019-14907 samba: Crash after failed character conversion at log level 3 or above
Fixed packages 28
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ctdb | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | ctdb-tests | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | libsmbclient | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | libsmbclient-devel | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | libwbclient | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | libwbclient-devel | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-client | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-client-libs | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-common | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-common-libs | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-common-tools | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-dc | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-dc-libs | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-debuginfo | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-devel | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-krb5-printing | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-libs | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-pidl | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-python | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-python-test | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-test | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-test-libs | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-vfs-glusterfs | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-winbind | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-winbind-clients | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-winbind-krb5-locator | 0:4.10.16-7.amzn2.0.1 |
| Amazon Linux · 2 | samba-winbind-modules | 0:4.10.16-7.amzn2.0.1 |
Vulnerabilities 1
-
Medium 6.5
All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-14907.html