SUSE alert openSUSE-SU-2025-20048-1 (samba)

From:
             
 
meissner@suse.com
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2025-20048-1: critical: Security update for samba
Date:
             
 
Fri, 21 Nov 2025 21:56:17 +0100
Message-ID:
             
 
<20251121205617.C6126FB9B@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for samba
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2025-20048-1
Rating: critical
References:

  * bsc#1249087
  * bsc#1249179
  * bsc#1249180
  * bsc#1249181
  * bsc#1251279
  * bsc#1251280



Cross-References:

  * CVE-2025-10230
  * CVE-2025-9640



CVSS scores:

  * CVE-2025-10230 ( SUSE ): 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  * CVE-2025-9640 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 2 vulnerabilities and has 6 bug fixes can now be installed.

Description:

This update for samba fixes the following issues:

Update to 4.22.5:

  * CVE-2025-10230: Command injection via WINS server hook script (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).

- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).

- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts (bsc#1249181).

- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used
  (bsc#1249180).

- don't attempt to label paths that don't exist, also remove
  unecessary evaluation of semange & restorecon cmds (bsc#1249179).

Update to 4.22.4:

  * netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with
    SysvolReady=0
  * getpwuid does not shift to new DC when current DC is down
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName-
  * Unresponsive second DC can cause idmapping failure when using
    idmap_ad-
  * kinit command is failing with Missing cache Error.
  * Figuring out the DC name from IP address fails and breaks
    fork_domain_child().
  * vfs_streams_depot fstatat broken.
  * Delayed leader broadcast can block ctdb forever.
  * Apparently there is a conflict between shadow_copy2 module
    and virusfilter (action quarantine).
  * Fix handling of empty GPO link.
  * SMB ACL inheritance doesn't work for files created.

- adjust gpgme build dependency for future-proofing



Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-22=1

Package List:

- openSUSE Leap 16.0:

  ctdb-4.22.5+git.431.dc5a539f124-160000.1.1
  ctdb-pcp-pmda-4.22.5+git.431.dc5a539f124-160000.1.1
  ldb-tools-4.22.5+git.431.dc5a539f124-160000.1.1
  libldb-devel-4.22.5+git.431.dc5a539f124-160000.1.1
  libldb2-4.22.5+git.431.dc5a539f124-160000.1.1
  python3-ldb-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-ad-dc-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-ad-dc-libs-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-ceph-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-client-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-client-libs-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-dcerpc-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-devel-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-doc-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-dsdb-modules-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-gpupdate-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-ldb-ldap-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-libs-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-libs-python3-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-python3-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-test-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-tool-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-winbind-4.22.5+git.431.dc5a539f124-160000.1.1
  samba-winbind-libs-4.22.5+git.431.dc5a539f124-160000.1.1

References:

  * https://www.suse.com/security/cve/CVE-2025-10230.html
  * https://www.suse.com/security/cve/CVE-2025-9640.html