As per upstream advisory:
Samba as an Active Directory Domain Controller is able to support an RODC, which is meant to have minimal privileges in a domain.
However, in accepting a ticket from a Samba or Windows RODC, Samba was not confirming that the RODC is authorized to print such a ticket, via the msDS-NeverRevealGroup and msDS-RevealOnDemandGroup (typically "Allowed RODC Replication Group" and "Denied RODC Replciation Group").
This would allow an RODC to print administrator tickets.
Created samba tracking bugs for this issue:
Affects: fedora-all [bug 2021718]
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):