diff options
Diffstat (limited to 'ChangeLog.rss')
| -rw-r--r-- | ChangeLog.rss | 52 |
1 files changed, 50 insertions, 2 deletions
diff --git a/ChangeLog.rss b/ChangeLog.rss index 967c2b557..adde38e79 100644 --- a/ChangeLog.rss +++ b/ChangeLog.rss @@ -11,10 +11,58 @@ <description>Tracking Slackware development in git.</description> <language>en-us</language> <id xmlns="http://www.w3.org/2005/Atom">urn:uuid:c964f45e-6732-11e8-bbe5-107b4450212f</id> - <pubDate>Wed, 14 Dec 2022 21:19:34 GMT</pubDate> - <lastBuildDate>Thu, 15 Dec 2022 12:30:40 GMT</lastBuildDate> + <pubDate>Sat, 17 Dec 2022 21:14:11 GMT</pubDate> + <lastBuildDate>Sun, 18 Dec 2022 12:29:56 GMT</lastBuildDate> <generator>maintain_current_git.sh v 1.17</generator> <item> + <title>Sat, 17 Dec 2022 21:14:11 GMT</title> + <pubDate>Sat, 17 Dec 2022 21:14:11 GMT</pubDate> + <link>https://git.slackware.nl/current/tag/?h=20221217211411</link> + <guid isPermaLink="false">20221217211411</guid> + <description> + <![CDATA[<pre> +patches/packages/samba-4.15.13-x86_64-1_slack15.0.txz: Upgraded. + This update fixes security issues: + This is the Samba CVE for the Windows Kerberos RC4-HMAC Elevation of + Privilege Vulnerability disclosed by Microsoft on Nov 8 2022. + A Samba Active Directory DC will issue weak rc4-hmac session keys for + use between modern clients and servers despite all modern Kerberos + implementations supporting the aes256-cts-hmac-sha1-96 cipher. + On Samba Active Directory DCs and members + 'kerberos encryption types = legacy' + would force rc4-hmac as a client even if the server supports + aes128-cts-hmac-sha1-96 and/or aes256-cts-hmac-sha1-96. + This is the Samba CVE for the Windows Kerberos Elevation of Privilege + Vulnerability disclosed by Microsoft on Nov 8 2022. + A service account with the special constrained delegation permission + could forge a more powerful ticket than the one it was presented with. + The "RC4" protection of the NetLogon Secure channel uses the same + algorithms as rc4-hmac cryptography in Kerberos, and so must also be + assumed to be weak. + Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability + was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed + that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue + rc4-hmac encrypted tickets despite the target server supporting better + encryption (eg aes256-cts-hmac-sha1-96). + Note that there are several important behavior changes included in this + release, which may cause compatibility problems interacting with system + still expecting the former behavior. + Please read the advisories of CVE-2022-37966, CVE-2022-37967 and + CVE-2022-38023 carefully! + For more information, see: + https://www.samba.org/samba/security/CVE-2022-37966.html + https://www.samba.org/samba/security/CVE-2022-37967.html + https://www.samba.org/samba/security/CVE-2022-38023.html + https://www.samba.org/samba/security/CVE-2022-45141.html + https://www.cve.org/CVERecord?id=CVE-2022-37966 + https://www.cve.org/CVERecord?id=CVE-2022-37967 + https://www.cve.org/CVERecord?id=CVE-2022-38023 + https://www.cve.org/CVERecord?id=CVE-2022-45141 + (* Security fix *) + </pre>]]> + </description> + </item> + <item> <title>Wed, 14 Dec 2022 21:19:34 GMT</title> <pubDate>Wed, 14 Dec 2022 21:19:34 GMT</pubDate> <link>https://git.slackware.nl/current/tag/?h=20221214211934</link> |