[Buildroot] [git commit branch/2025.02.x] package/samba4: security bump to v4.22.11

commit: https://gitlab.com/buildroot.org/buildroot/-/commit/af97fbb9ca5c8e1eaef4ef182836c2b61774ee00
branch: https://gitlab.com/buildroot.org/buildroot/-/tree/2025.02.x

See the release notes: https://www.samba.org/samba/history/samba-4.22.11.html

This is a security release in order to address the following defects:
o CVE-2026-6949:   TSIG packet with name compression can crash DNS

                   Incorrect size calculations when a TSIG record contains
                   compressed names can lead to a large out-of-bounds write
                   causing the server to crash.

                   https://www.samba.org/samba/security/CVE-2026-6949.html

o CVE-2026-58216:  An authenticated user could possibly crash a KDC process

                   A kpasswd packet that contains malformed ASN.1 might cause
                   the server to access 6 bytes of unallocated memory. This
                   memory is not exposed to the user, but in some
                   circumstances the server could crash.

                   https://www.samba.org/samba/security/CVE-2026-58216.html

o CVE-2026-58218:  DNS signing DoS via TKEY name cache exhaustion

                   An unauthenticated user can repeatedly register names TKEY
                   names, which floods a cache causing legitimate TKEYs to be
                   expunged. This can practically block the use DNS TSIG
                   signing.

                   https://www.samba.org/samba/security/CVE-2026-58218.html

o CVE-2026-58221:  Samba AD authenticated LDAP access domain takeover

                   Samba AD low-privilege authenticated LDAP access allows
                   modifications to internal LDB special DNs, which permits a
                   domain takeover.

                   https://www.samba.org/samba/security/CVE-2026-58221.html

o CVE-2026-58222:  Samba AD LDAP Compare filter injection and trusted-request
                   confusion disclose protected attributes

                   An ordinary authenticated domain user can bypass access
                   checks and query confidential Active Directory attributes
                   (such as KDS root keys) via LDAP Compare requests. Due to a
                   filter injection flaw and trusted execution context, the
                   LDAP Compare operation can be turned into a
                   protected-attribute disclosure oracle.

                   https://www.samba.org/samba/security/CVE-2026-58222.html

o CVE-2026-58224   The CTDB protocol has bounds checking issues

                   CTDB fails to do integrity checking of received packets.
                   This includes failure to check field lengths against packet
                   lengths when unmarshalling packets.

                   https://www.samba.org/samba/security/CVE-2026-58224.html

(alternative to commit b5e6133eabd3371f999f26215ac70406530eb0d9)
Signed-off-by: Titouan Christophe <[email protected]>
---
 package/samba4/samba4.hash | 4 ++--
 package/samba4/samba4.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/samba4/samba4.hash b/package/samba4/samba4.hash
index 1875343d11..ad60feaa2a 100644
--- a/package/samba4/samba4.hash
+++ b/package/samba4/samba4.hash
@@ -1,4 +1,4 @@
 # Locally calculated after checking pgp signature
-# https://download.samba.org/pub/samba/stable/samba-4.22.10.tar.asc
-sha256  e601437cde4845a42e7818379cd0ad5fc4fa518a7cf5284cc0a2657e79b30c34  samba-4.22.10.tar.gz
+# https://download.samba.org/pub/samba/stable/samba-4.22.11.tar.asc
+sha256  d569b298a81cc212a39e9d1813bc4ca5c71ac93c4ceb2eec03db178096958d00  samba-4.22.11.tar.gz
 sha256  8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903  COPYING
diff --git a/package/samba4/samba4.mk b/package/samba4/samba4.mk
index 50ae8ba6af..3cbcbd0dd1 100644
--- a/package/samba4/samba4.mk
+++ b/package/samba4/samba4.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-SAMBA4_VERSION = 4.22.10
+SAMBA4_VERSION = 4.22.11
 SAMBA4_SITE = https://download.samba.org/pub/samba/stable
 SAMBA4_SOURCE = samba-$(SAMBA4_VERSION).tar.gz
 SAMBA4_INSTALL_STAGING = YES
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot