Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Samba components can let attackers run commands or misuse certificates
published 4 months ago
Summary
Certain Samba libraries used on CentOS Stream may accept certificate information from insecure web sources and may treat a user name that includes special characters as a command. This could allow an attacker to cause the system to run unwanted commands or trust forged certificates. Update the Samba packages to the latest versions provided by your vendor to fix these weaknesses.
What to do
- Update centos-stream libnetapi-devel to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream ctdb to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream libnetapi to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream libsmbclient to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream libsmbclient-devel to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream libwbclient to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream libwbclient-devel to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream python3-samba to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream python3-samba-dc to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream python3-samba-devel to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream python3-samba-test to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-client to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-client-libs to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-common to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-common-libs to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-common-tools to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-dc-libs to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-dcerpc to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-devel to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-krb5-printing to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-ldb-ldap-modules to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-libs to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-pidl to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-test to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-test-libs to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-tools to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-usershares to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-vfs-iouring to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-winbind to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-winbind-clients to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-winbind-krb5-locator to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-winbind-modules to version 4.19.4-4.el8.tuxcare.els2.
- Update centos-stream samba-winexe to version 4.19.4-4.el8.tuxcare.els2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS-Stream:8 | centos-stream | libnetapi-devel |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | ctdb |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | libnetapi |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | libsmbclient |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | libsmbclient-devel |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | libwbclient |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | libwbclient-devel |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | python3-samba |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | python3-samba-dc |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | python3-samba-devel |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | python3-samba-test |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-client |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-client-libs |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-common |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-common-libs |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-common-tools |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-dc-libs |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-dcerpc |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-devel |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-krb5-printing |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-ldb-ldap-modules |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-libs |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-pidl |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-test |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-test-libs |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-tools |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-usershares |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-vfs-iouring |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-winbind |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-winbind-clients |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-winbind-krb5-locator |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-winbind-modules |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
| TuxCare:CentOS-Stream:8 | centos-stream | samba-winexe |
< 4.19.4-4.el8.tuxcare.els2 Fix: upgrade to 4.19.4-4.el8.tuxcare.els2
|
Original advisory text
samba: Fix of 2 CVEs
- CVE-2026-3012: do not trust CA certificates fetched over HTTP in the
certificate auto-enrollment GP extension; use only LDAP-derived
certificates and skip CAs with no cACertificate attribute
- CVE-2026-4408: escape shell metacharacters in the client-controlled
username before substituting it into the "check password script" via
%u, preventing remote command injection
certificate auto-enrollment GP extension; use only LDAP-derived
certificates and skip CAs with no cACertificate attribute
- CVE-2026-4408: escape shell metacharacters in the client-controlled
username before substituting it into the "check password script" via
%u, preventing remote command injection
References
- https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1781101271.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-3012 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-4408 Vendor Advisory
Timeline
Published10 Jun 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1781101271 · OSV
Track software like this
Free during beta