Bug 2154362 (CVE-2022-38023) - CVE-2022-38023 samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided
Summary: CVE-2022-38023 samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-38023
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Engineering2160019 2154363 Red Hat2154364 Red Hat2154365 Red Hat2154366 Red Hat2154367 Red Hat2154368 Red Hat2154369 Red Hat2154370 Red Hat2154371 Red Hat2154372 Red Hat2154373
Blocks: Embargoed2154280
TreeView+ depends on / blocked
 
Reported: 2022-12-16 17:47 UTC by Marco Benatto
Modified: 2023-05-17 02:33 UTC (History)
20 users (show)

Fixed In Version: samba 4.15.13, samba 4.16.8, samba 4.15.13
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in samba. The Netlogon RPC implementations may use the rc4-hmac encryption algorithm, which is considered weak and should be avoided even if the client supports more modern encryption types. This issue could allow an attacker who knows the plain text content communicated between the samba client and server to craft data with the same MD5 calculation and replace it without being detected.
Clone Of:
Environment:
Last Closed: 2023-05-17 02:33:27 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker OSCI-5084 0 None None None 2023-05-03 12:59:11 UTC
Red Hat Product Errata RHSA-2023:0637 0 None None None 2023-02-07 21:28:36 UTC
Red Hat Product Errata RHSA-2023:0638 0 None None None 2023-02-07 22:17:26 UTC
Red Hat Product Errata RHSA-2023:0639 0 None None None 2023-02-07 22:17:42 UTC
Red Hat Product Errata RHSA-2023:0838 0 None None None 2023-02-21 09:22:32 UTC
Red Hat Product Errata RHSA-2023:1090 0 None None None 2023-03-07 09:53:55 UTC
Red Hat Product Errata RHSA-2023:2127 0 None None None 2023-05-04 13:20:38 UTC
Red Hat Product Errata RHSA-2023:2136 0 None None None 2023-05-04 18:31:02 UTC
Red Hat Product Errata RHSA-2023:2137 0 None None None 2023-05-04 19:34:24 UTC

Description Marco Benatto 2022-12-16 17:47:06 UTC 
The "RC4" protection of the NetLogon Secure channel uses the same algorithms as rc4-hmac cryptography in Kerberos, and so must also be assumed to be weak.
Comment 1 Marco Benatto 2022-12-16 17:48:09 UTC 
Created samba tracking bugs for this issue:

Affects: fedora-all [bug 2154363]
Comment 13 errata-xmlrpc 2023-02-07 21:28:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:0637 https://access.redhat.com/errata/RHSA-2023:0637
Comment 14 errata-xmlrpc 2023-02-07 22:17:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2023:0638 https://access.redhat.com/errata/RHSA-2023:0638
Comment 15 errata-xmlrpc 2023-02-07 22:17:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2023:0639 https://access.redhat.com/errata/RHSA-2023:0639
Comment 17 errata-xmlrpc 2023-02-21 09:22:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:0838 https://access.redhat.com/errata/RHSA-2023:0838
Comment 21 errata-xmlrpc 2023-03-07 09:53:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2023:1090 https://access.redhat.com/errata/RHSA-2023:1090
Comment 22 Ram Gopireddy 2023-03-08 01:20:36 UTC 
Doesn't this issue impact RHEL 8.6? If it does not, shouldn't the CVE page(https://access.redhat.com/security/cve/cve-2022-38023) explicitly state that? 

I have a customer who is complaining about this CVE in CoreOS 4.11.28 (shipped with their ARO cluster). CoreOS 4.11.28 is built with RHEL 8.6 EUS (https://access.redhat.com/articles/6907891)
Comment 24 errata-xmlrpc 2023-05-04 13:20:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2127 https://access.redhat.com/errata/RHSA-2023:2127
Comment 25 errata-xmlrpc 2023-05-04 18:31:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:2136 https://access.redhat.com/errata/RHSA-2023:2136
Comment 26 errata-xmlrpc 2023-05-04 19:34:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:2137 https://access.redhat.com/errata/RHSA-2023:2137
Comment 28 Product Security DevOps Team 2023-05-17 02:33:25 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-38023
Note You need to log in before you can comment on or make changes to this bug.