samba-4.22.2

[Bruce Dubbs]

New point version.

[Douglas R. Reno]

                   ==============================
                   Release Notes for Samba 4.22.2
                           June 05, 2025
                   ==============================


This is the latest stable release of the Samba 4.22 release series.
It contains the security-relevant bugfix CVE-2025-0620:

    smbd doesn't pick up group membership changes
    when re-authenticating an expired SMB session
    https://www.samba.org/samba/security/CVE-2025-0620.html


Description of CVE-2025-0620
-----------------------------

    With Kerberos authentication SMB sessions typically have an
    associated lifetime, requiring re-authentication by the
    client when the session expires. As part of the
    re-authentication, Samba receives the current group
    membership information and is expected to reflect this
    change in further SMB request processing.

    For historic reasons, Samba maintains a cache of
    associations between a user's impersonation information and
    connected shares. A recent change in this cache caused Samba
    to not reflect group membership changes from session
    re-authentication when processing further SMB requests.

    As a result, when an administrator removes a user from a
    particular group in Active Directory, this change will not
    become effective unless the user disconnects from the server
    and establishes a new connection.


Changes since 4.22.1
--------------------

o  Ralph Boehme <slow@samba.org>
   * BUG 15707: (CVE-2025-0620) [SECURITY] CVE-2025-0620: smbd doesn't pick up
     group membership changes when re-authenticating an expired SMB
     session.
   * BUG 15861: Profile sync fails due to Directory Leases.

o  Pavel Filipenský <pfilipensky@samba.org>
   * BUG 15727: net ad join fails with "Failed to join domain: failed to create
     kerberos keytab".

o  Stefan Metzmacher <metze@samba.org>
   * BUG 15851: dcerpcd not able to bind to listening port.

o  Anoop C S <anoopcs@samba.org>
   * BUG 15819: vfs_ceph_snapshots fails to list snapshots for entries at any
     level beyond share root.

o  Martin Schwenke <mschwenke@ddn.com>
   * BUG 15858: CTDB does not put nodes running NFS into grace on graceful
     shutdown.

[Douglas R. Reno]

We don't have Active Directory support in the BLFS configuration, but I will file an advisory anyway for this for people who do have it.

[Douglas R. Reno]

Fixed at 3947629a8f4f7cc7e4d05fc85b374e93107eadb0

[Douglas R. Reno]

SA-12.3-052 issued