Bug 2154362 (CVE-2022-38023)

Summary:	CVE-2022-38023 samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided
Product:	[Other] Security Response	Reporter:	Marco Benatto <mbenatto>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abokovoy, aboscatt, anoopcs, arachman, asn, bthekkep, cbesson, cchiang, dkarpele, gdeschner, kyoshida, lveyde, mdogra, michal.skrivanek, mperina, pfilipen, rgopired, rhs-smb, sbalasub, sbonazzo
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	samba 4.15.13, samba 4.16.8, samba 4.15.13	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in samba. The Netlogon RPC implementations may use the rc4-hmac encryption algorithm, which is considered weak and should be avoided even if the client supports more modern encryption types. This issue could allow an attacker who knows the plain text content communicated between the samba client and server to craft data with the same MD5 calculation and replace it without being detected.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-17 02:33:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2154363, 2154364, 2154365, 2154366, 2154367, 2154368, 2154369, 2154370, 2154371, 2154372, 2154373, 2160019
Bug Blocks:	2154280

Description Marco Benatto 2022-12-16 17:47:06 UTC

The "RC4" protection of the NetLogon Secure channel uses the same algorithms as rc4-hmac cryptography in Kerberos, and so must also be assumed to be weak.

Comment 1 Marco Benatto 2022-12-16 17:48:09 UTC

Created samba tracking bugs for this issue:

Affects: fedora-all [bug 2154363]

Comment 13 errata-xmlrpc 2023-02-07 21:28:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:0637 https://access.redhat.com/errata/RHSA-2023:0637

Comment 14 errata-xmlrpc 2023-02-07 22:17:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2023:0638 https://access.redhat.com/errata/RHSA-2023:0638

Comment 15 errata-xmlrpc 2023-02-07 22:17:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2023:0639 https://access.redhat.com/errata/RHSA-2023:0639

Comment 17 errata-xmlrpc 2023-02-21 09:22:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:0838 https://access.redhat.com/errata/RHSA-2023:0838

Comment 21 errata-xmlrpc 2023-03-07 09:53:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2023:1090 https://access.redhat.com/errata/RHSA-2023:1090

Comment 22 Ram Gopireddy 2023-03-08 01:20:36 UTC

Doesn't this issue impact RHEL 8.6? If it does not, shouldn't the CVE page(https://access.redhat.com/security/cve/cve-2022-38023) explicitly state that? 

I have a customer who is complaining about this CVE in CoreOS 4.11.28 (shipped with their ARO cluster). CoreOS 4.11.28 is built with RHEL 8.6 EUS (https://access.redhat.com/articles/6907891)

Comment 24 errata-xmlrpc 2023-05-04 13:20:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2127 https://access.redhat.com/errata/RHSA-2023:2127

Comment 25 errata-xmlrpc 2023-05-04 18:31:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:2136 https://access.redhat.com/errata/RHSA-2023:2136

Comment 26 errata-xmlrpc 2023-05-04 19:34:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:2137 https://access.redhat.com/errata/RHSA-2023:2137

Comment 28 Product Security DevOps Team 2023-05-17 02:33:25 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-38023

Comment 29 errata-xmlrpc 2023-06-06 14:11:51 UTC

This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Via RHSA-2023:3491 https://access.redhat.com/errata/RHSA-2023:3491