<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for samba</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2021:3674-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2021-11-16T14:15:53Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2021-11-16T14:15:53Z</InitialReleaseDate>
    <CurrentReleaseDate>2021-11-16T14:15:53Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for samba</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for samba fixes the following issues:

- CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
- CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">openSUSE-SLE-15.3-2021-3674</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZYEHJEQQ7LEL2T775B7QLR3IFR6LJGLZ/</URL>
      <Description>E-Mail link for openSUSE-SU-2021:3674-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1014440</URL>
      <Description>SUSE Bug 1014440</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1192284</URL>
      <Description>SUSE Bug 1192284</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-2124/</URL>
      <Description>SUSE CVE CVE-2016-2124 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-25717/</URL>
      <Description>SUSE CVE CVE-2020-25717 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="openSUSE Leap 15.3">
      <Branch Type="Product Name" Name="openSUSE Leap 15.3">
        <FullProductName ProductID="openSUSE Leap 15.3" CPE="cpe:/o:opensuse:leap:15.3">openSUSE Leap 15.3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libsamba-policy-python-devel-4.9.5+git.471.5edbe3dcae7-3.57.2">
      <FullProductName ProductID="libsamba-policy-python-devel-4.9.5+git.471.5edbe3dcae7-3.57.2">libsamba-policy-python-devel-4.9.5+git.471.5edbe3dcae7-3.57.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libsamba-policy0-4.9.5+git.471.5edbe3dcae7-3.57.2">
      <FullProductName ProductID="libsamba-policy0-4.9.5+git.471.5edbe3dcae7-3.57.2">libsamba-policy0-4.9.5+git.471.5edbe3dcae7-3.57.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libsamba-policy0-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2">
      <FullProductName ProductID="libsamba-policy0-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2">libsamba-policy0-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="samba-libs-python-4.9.5+git.471.5edbe3dcae7-3.57.2">
      <FullProductName ProductID="samba-libs-python-4.9.5+git.471.5edbe3dcae7-3.57.2">samba-libs-python-4.9.5+git.471.5edbe3dcae7-3.57.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="samba-libs-python-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2">
      <FullProductName ProductID="samba-libs-python-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2">samba-libs-python-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="samba-python-4.9.5+git.471.5edbe3dcae7-3.57.2">
      <FullProductName ProductID="samba-python-4.9.5+git.471.5edbe3dcae7-3.57.2">samba-python-4.9.5+git.471.5edbe3dcae7-3.57.2</FullProductName>
    </Branch>
    <Relationship ProductReference="libsamba-policy-python-devel-4.9.5+git.471.5edbe3dcae7-3.57.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:libsamba-policy-python-devel-4.9.5+git.471.5edbe3dcae7-3.57.2">libsamba-policy-python-devel-4.9.5+git.471.5edbe3dcae7-3.57.2 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libsamba-policy0-4.9.5+git.471.5edbe3dcae7-3.57.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:libsamba-policy0-4.9.5+git.471.5edbe3dcae7-3.57.2">libsamba-policy0-4.9.5+git.471.5edbe3dcae7-3.57.2 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libsamba-policy0-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:libsamba-policy0-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2">libsamba-policy0-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="samba-libs-python-4.9.5+git.471.5edbe3dcae7-3.57.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:samba-libs-python-4.9.5+git.471.5edbe3dcae7-3.57.2">samba-libs-python-4.9.5+git.471.5edbe3dcae7-3.57.2 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="samba-libs-python-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:samba-libs-python-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2">samba-libs-python-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="samba-python-4.9.5+git.471.5edbe3dcae7-3.57.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:samba-python-4.9.5+git.471.5edbe3dcae7-3.57.2">samba-python-4.9.5+git.471.5edbe3dcae7-3.57.2 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.</Note>
    </Notes>
    <CVE>CVE-2016-2124</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 15.3:libsamba-policy-python-devel-4.9.5+git.471.5edbe3dcae7-3.57.2</ProductID>
        <ProductID>openSUSE Leap 15.3:libsamba-policy0-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2</ProductID>
        <ProductID>openSUSE Leap 15.3:libsamba-policy0-4.9.5+git.471.5edbe3dcae7-3.57.2</ProductID>
        <ProductID>openSUSE Leap 15.3:samba-libs-python-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2</ProductID>
        <ProductID>openSUSE Leap 15.3:samba-libs-python-4.9.5+git.471.5edbe3dcae7-3.57.2</ProductID>
        <ProductID>openSUSE Leap 15.3:samba-python-4.9.5+git.471.5edbe3dcae7-3.57.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.9</BaseScoreV2>
        <VectorV2>AV:A/AC:M/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZYEHJEQQ7LEL2T775B7QLR3IFR6LJGLZ/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-2124.html</URL>
        <Description>CVE-2016-2124</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1014440</URL>
        <Description>SUSE Bug 1014440</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.</Note>
    </Notes>
    <CVE>CVE-2020-25717</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 15.3:libsamba-policy-python-devel-4.9.5+git.471.5edbe3dcae7-3.57.2</ProductID>
        <ProductID>openSUSE Leap 15.3:libsamba-policy0-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2</ProductID>
        <ProductID>openSUSE Leap 15.3:libsamba-policy0-4.9.5+git.471.5edbe3dcae7-3.57.2</ProductID>
        <ProductID>openSUSE Leap 15.3:samba-libs-python-32bit-4.9.5+git.471.5edbe3dcae7-3.57.2</ProductID>
        <ProductID>openSUSE Leap 15.3:samba-libs-python-4.9.5+git.471.5edbe3dcae7-3.57.2</ProductID>
        <ProductID>openSUSE Leap 15.3:samba-python-4.9.5+git.471.5edbe3dcae7-3.57.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>8.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:S/C:C/I:C/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.1</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZYEHJEQQ7LEL2T775B7QLR3IFR6LJGLZ/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-25717.html</URL>
        <Description>CVE-2020-25717</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1192284</URL>
        <Description>SUSE Bug 1192284</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1192505</URL>
        <Description>SUSE Bug 1192505</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1192601</URL>
        <Description>SUSE Bug 1192601</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1192849</URL>
        <Description>SUSE Bug 1192849</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1193011</URL>
        <Description>SUSE Bug 1193011</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1194049</URL>
        <Description>SUSE Bug 1194049</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1194307</URL>
        <Description>SUSE Bug 1194307</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1195815</URL>
        <Description>SUSE Bug 1195815</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1196344</URL>
        <Description>SUSE Bug 1196344</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1196717</URL>
        <Description>SUSE Bug 1196717</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1196920</URL>
        <Description>SUSE Bug 1196920</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1205061</URL>
        <Description>SUSE Bug 1205061</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
