Linux · Amazon Linux · Security advisory · February 17, 2023

ALAS2023-2023-032: Security update for 52 packages

ALAS2023-2023-032, released February 17, 2023, fixes 16 CVEs across 52 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
16
2 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.1379
96th percentile

Priority of the 16 CVEs

Patch now 0 Urgent 3 High 6 Routine 7

Fixed package versions

ProductReleaseFixed in
libnetapiamzn 20232:4.17.5-0.amzn2023.0.2
libnetapi-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
libnetapi-develamzn 20232:4.17.5-0.amzn2023.0.2
libsmbclientamzn 20232:4.17.5-0.amzn2023.0.2
libsmbclient-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
libsmbclient-develamzn 20232:4.17.5-0.amzn2023.0.2
libwbclientamzn 20232:4.17.5-0.amzn2023.0.2
libwbclient-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
libwbclient-develamzn 20232:4.17.5-0.amzn2023.0.2
python3-sambaamzn 20232:4.17.5-0.amzn2023.0.2
python3-samba-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
python3-samba-develamzn 20232:4.17.5-0.amzn2023.0.2
python3-samba-testamzn 20232:4.17.5-0.amzn2023.0.2
sambaamzn 20232:4.17.5-0.amzn2023.0.2
samba-clientamzn 20232:4.17.5-0.amzn2023.0.2
samba-client-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-client-libsamzn 20232:4.17.5-0.amzn2023.0.2
samba-client-libs-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-commonamzn 20232:4.17.5-0.amzn2023.0.2
samba-common-libsamzn 20232:4.17.5-0.amzn2023.0.2
samba-common-libs-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-common-toolsamzn 20232:4.17.5-0.amzn2023.0.2
samba-common-tools-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-dc-libsamzn 20232:4.17.5-0.amzn2023.0.2
samba-dc-libs-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-dcerpcamzn 20232:4.17.5-0.amzn2023.0.2
samba-dcerpc-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-debugsourceamzn 20232:4.17.5-0.amzn2023.0.2
samba-develamzn 20232:4.17.5-0.amzn2023.0.2
samba-krb5-printingamzn 20232:4.17.5-0.amzn2023.0.2
samba-krb5-printing-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-ldb-ldap-modulesamzn 20232:4.17.5-0.amzn2023.0.2
samba-ldb-ldap-modules-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-libsamzn 20232:4.17.5-0.amzn2023.0.2
samba-libs-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-pidlamzn 20232:4.17.5-0.amzn2023.0.2
samba-testamzn 20232:4.17.5-0.amzn2023.0.2
samba-test-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-test-libsamzn 20232:4.17.5-0.amzn2023.0.2
samba-test-libs-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-usersharesamzn 20232:4.17.5-0.amzn2023.0.2
samba-vfs-iouringamzn 20232:4.17.5-0.amzn2023.0.2
samba-vfs-iouring-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-winbindamzn 20232:4.17.5-0.amzn2023.0.2
samba-winbind-clientsamzn 20232:4.17.5-0.amzn2023.0.2
samba-winbind-clients-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-winbind-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-winbind-krb5-locatoramzn 20232:4.17.5-0.amzn2023.0.2
samba-winbind-krb5-locator-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2
samba-winbind-modulesamzn 20232:4.17.5-0.amzn2023.0.2
samba-winbind-modules-debuginfoamzn 20232:4.17.5-0.amzn2023.0.2

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2022-37967 Windows Kerberos Elevation of Privilege Vulnerability7.2 0.0482 More likely
Urgent CVE-2022-37966 Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability8.1 0.0294 More likely
Urgent CVE-2022-38023 Netlogon RPC Elevation of Privilege Vulnerability8.1 0.0275 More likely
High CVE-2020-17049 Kerberos KDC Security Feature Bypass Vulnerability7.2 0.1379 Exploitation Less Likely
High CVE-2022-3592 libnetapi: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-45141: Samba AD...n/a 0.0271 None reported
High CVE-2016-2124 ctdb: A flaw was found in the way samba implemented SMB1 authentication8.1 0.0177 None reported
High CVE-2022-0336 samba: The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not...8.8 0.0176 None reported
High CVE-2022-32743 samba: Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileg...7.5 0.0157 None reported
High CVE-2022-45141 samba-common: Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and...9.8 0.0045 None reported
Routine CVE-2022-3437 Heimdal: A user in a privileged network position may be able to leak sensitive user information6.5 0.0383 None reported
Routine CVE-2022-32746 samba: A flaw was found in the Samba AD LDAP server5.4 0.0132 None reported
Routine CVE-2022-32742 ctdb: A flaw was found in Samba4.3 0.0131 None reported
Routine CVE-2021-44141 ctdb: Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet Fil...6.5 0.0109 None reported
Routine CVE-2021-20316 ctdb: Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet Fil...6.8 0.0104 None reported
Routine CVE-2022-1615 ctdb: Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet Fil...5.5 0.0053 None reported
Routine CVE-2021-43566 ctdb: All versions of Samba prior to 4.13.16 are vulnerable to a malicious clientusing an SMB1 or NFS race to allow a direc...2.6 0.0041 None reported
Showing 1 to 16 of 16 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.