CVS commit: pkgsrc/net/samba4

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Thu Jul 30 15:37:00 UTC 2026

Modified Files:
        pkgsrc/net/samba4: Makefile distinfo
        pkgsrc/net/samba4/patches: patch-lib_util_util__crypt.c

Log Message:
net/samba4: update to 4.24.5

pkgsrc change:

* remove pkglint warnings of patches/patch-lib_util_util__crypt.c

                   ==============================
                   Release Notes for Samba 4.24.5
                           July 28, 2026
                   ==============================

This is a security release in order to address the following defects:

o CVE-2026-6949:   TSIG packet with name compression can crash DNS

                   Incorrect size calculations when a TSIG record contains
                   compressed names can lead to a large out-of-bounds write
                   causing the server to crash.

                   https://www.samba.org/samba/security/CVE-2026-6949.html

o CVE-2026-58216:  An authenticated user could possibly crash a KDC process

                   A kpasswd packet that contains malformed ASN.1 might cause
                   the server to access 6 bytes of unallocated memory. This
                   memory is not exposed to the user, but in some
                   circumstances the server could crash.

                   https://www.samba.org/samba/security/CVE-2026-58216.html

o CVE-2026-58218:  DNS signing DoS via TKEY name cache exhaustion

                   An unauthenticated user can repeatedly register names TKEY
                   names, which floods a cache causing legitimate TKEYs to be
                   expunged. This can practically block the use DNS TSIG
                   signing.

                   https://www.samba.org/samba/security/CVE-2026-58218.html

o CVE-2026-58221:  Samba AD authenticated LDAP access domain takeover

                   Samba AD low-privilege authenticated LDAP access allows
                   modifications to internal LDB special DNs, which permits a
                   domain takeover.

                   https://www.samba.org/samba/security/CVE-2026-58221.html

o CVE-2026-58222:  Samba AD LDAP Compare filter injection and trusted-request
                   confusion disclose protected attributes

                   An ordinary authenticated domain user can bypass access
                   checks and query confidential Active Directory attributes
                   (such as KDS root keys) via LDAP Compare requests. Due to a
                   filter injection flaw and trusted execution context, the
                   LDAP Compare operation can be turned into a
                   protected-attribute disclosure oracle.

                   https://www.samba.org/samba/security/CVE-2026-58222.html

o CVE-2026-58224   The CTDB protocol has bounds checking issues

                   CTDB fails to do integrity checking of received packets.
                   This includes failure to check field lengths against packet
                   lengths when unmarshalling packets.

                   https://www.samba.org/samba/security/CVE-2026-58224.html

Changes since 4.24.4
--------------------

o  Douglas Bagnall <douglas.bagnall%catalyst.net.nz@localhost>
   * BUG 16087: CVE-2026-58216

o  Volker Lendecke <vl%samba.org@localhost>
   * BUG 16115: CVE-2026-58218

o  Stefan Metzmacher <metze%samba.org@localhost>
   * BUG 16083: CVE-2026-6949
   * BUG 16147: CVE-2026-58221
   * BUG 16148: CVE-2026-58222

o  Martin Schwenke <mschwenke%ddn.com@localhost>
   * BUG 16085: CVE-2026-58224


To generate a diff of this commit:
cvs rdiff -u -r1.219 -r1.220 pkgsrc/net/samba4/Makefile
cvs rdiff -u -r1.128 -r1.129 pkgsrc/net/samba4/distinfo
cvs rdiff -u -r1.3 -r1.4 \
    pkgsrc/net/samba4/patches/patch-lib_util_util__crypt.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/samba4/Makefile
diff -u pkgsrc/net/samba4/Makefile:1.219 pkgsrc/net/samba4/Makefile:1.220
--- pkgsrc/net/samba4/Makefile:1.219    Wed Jul  1 07:27:25 2026
+++ pkgsrc/net/samba4/Makefile  Thu Jul 30 15:37:00 2026
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.219 2026/07/01 07:27:25 adam Exp $
+# $NetBSD: Makefile,v 1.220 2026/07/30 15:37:00 taca Exp $
 
 # XXX: Fails to build when mit-krb5 is installed.
-DISTNAME=      samba-4.24.4
+DISTNAME=      samba-4.24.5
 CATEGORIES=    net
 MASTER_SITES=  https://download.samba.org/pub/samba/stable/
 

Index: pkgsrc/net/samba4/distinfo
diff -u pkgsrc/net/samba4/distinfo:1.128 pkgsrc/net/samba4/distinfo:1.129
--- pkgsrc/net/samba4/distinfo:1.128    Wed Jul 29 17:22:49 2026
+++ pkgsrc/net/samba4/distinfo  Thu Jul 30 15:37:00 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.128 2026/07/29 17:22:49 jperkin Exp $
+$NetBSD: distinfo,v 1.129 2026/07/30 15:37:00 taca Exp $
 
-BLAKE2s (samba-4.24.4.tar.gz) = b3bba50ea3da90441f5fb733a7f1004c745be7ef5076d985c417991873183698
-SHA512 (samba-4.24.4.tar.gz) = 3f6b8a99491d82fcb90115288e547b330afd452f7ed15f288085644a0ea9ccbd45645c5a75f2d5db6d2d888ff280e87ec252b48e0c064a0ca33cac39f24f123d
-Size (samba-4.24.4.tar.gz) = 43431734 bytes
+BLAKE2s (samba-4.24.5.tar.gz) = 77d982003d1cbeb4ab0c7e61869fd11718d37571223d38b4812312481b076687
+SHA512 (samba-4.24.5.tar.gz) = dadaee50c61cc8076bd5f4e6e3a8be13b6aa6aeff33991277c7f5398ba9dea32e8d966c0206dec9cad240b935768b707f9c9dd6b60c3db433dcf8ddb30134088
+Size (samba-4.24.5.tar.gz) = 43445051 bytes
 SHA1 (patch-buildtools_wafsamba_samba__conftests.py) = d927db17124d2bb5b382885e70a41f84c3929926
 SHA1 (patch-buildtools_wafsamba_samba__install.py) = d801340617da325e3bb70a90350e45cc8e383c2d
 SHA1 (patch-buildtools_wafsamba_samba__pidl.py) = b9015694b80c0e6382d75c806fd6e0eb92e5f998
@@ -21,7 +21,7 @@ SHA1 (patch-lib_util_charset_charset__ma
 SHA1 (patch-lib_util_smb__threads.h) = 817591a2b69f31ac29497a2006fe21f0b4b0aaea
 SHA1 (patch-lib_util_tfork.c) = a9acb5561c5bba76450c48904a22019c8b14cbec
 SHA1 (patch-lib_util_time.h) = 5048614e301cf6922ff7fa6693fa58bfe17ff10e
-SHA1 (patch-lib_util_util__crypt.c) = 1cd30f2bad4d469745a7e2ca146c591c8ecfec96
+SHA1 (patch-lib_util_util__crypt.c) = 476e5f501df0b87096a145005480980752109225
 SHA1 (patch-libcli_dns_wscript__build) = 4103a144aa1bb4662fd7a62270941f1a3d01fe89
 SHA1 (patch-nsswitch_stress-nss-libwbclient.c) = c546f00184b0d22b6c150e210962cdfc6fc12df2
 SHA1 (patch-nsswitch_winbind__nss__netbsd.c) = 1214bfbd7714b64f3ff3eb97b6f24e3d2629370f

Index: pkgsrc/net/samba4/patches/patch-lib_util_util__crypt.c
diff -u pkgsrc/net/samba4/patches/patch-lib_util_util__crypt.c:1.3 pkgsrc/net/samba4/patches/patch-lib_util_util__crypt.c:1.4
--- pkgsrc/net/samba4/patches/patch-lib_util_util__crypt.c:1.3  Fri Apr 17 08:35:42 2026
+++ pkgsrc/net/samba4/patches/patch-lib_util_util__crypt.c      Thu Jul 30 15:37:00 2026
@@ -1,11 +1,11 @@
-$NetBSD: patch-lib_util_util__crypt.c,v 1.3 2026/04/17 08:35:42 adam Exp $
+$NetBSD: patch-lib_util_util__crypt.c,v 1.4 2026/07/30 15:37:00 taca Exp $
 
 Account for platforms that don't define ENOTRECOVERABLE, like NetBSD
 before 10.0.
 
 --- lib/util/util_crypt.c.orig 2025-02-17 15:48:20.606155400 +0000
 +++ lib/util/util_crypt.c
-@@ -62,7 +64,11 @@ static int crypt_as_best_we_can(TALLOC_C
+@@ -64,7 +64,11 @@ static int crypt_as_best_we_can(TALLOC_C
        if (hash == NULL || hash[0] == '*') {
                if (ret == 0) {
                        /* this is annoying */
@@ -17,7 +17,7 @@ before 10.0.
                }
        }
        if (ret != 0) {
-@@ -107,7 +113,11 @@ char *talloc_crypt_errstring(TALLOC_CTX 
+@@ -109,7 +113,11 @@ char *talloc_crypt_errstring(TALLOC_CTX 
                        mem_ctx,
                        "Password exceeds maximum length allowed for crypt() hashing");
        }