diff options
| author | Stefan Metzmacher <metze@samba.org> | 2022-12-05 21:31:37 +0100 |
|---|---|---|
| committer | Stefan Metzmacher <metze@samba.org> | 2022-12-13 13:07:29 +0000 |
| commit | a4f6f51cbed53775cdfedc7eec2f28c7beb875cc (patch) | |
| tree | a675fc49aed8fb7680d36d79e387b4365c81c5bf | |
| parent | 4d540473c3d43d048a30dd63efaeae9ff87b2aeb (diff) | |
| download | samba-a4f6f51cbed53775cdfedc7eec2f28c7beb875cc.tar.gz | |
CVE-2022-37966 docs-xml/smbdotconf: "kerberos encryption types = legacy" should not be used
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
| -rw-r--r-- | docs-xml/smbdotconf/security/kerberosencryptiontypes.xml | 12 |
1 files changed, 3 insertions, 9 deletions
diff --git a/docs-xml/smbdotconf/security/kerberosencryptiontypes.xml b/docs-xml/smbdotconf/security/kerberosencryptiontypes.xml index 2c3c6c5d5fc..a245af55f5f 100644 --- a/docs-xml/smbdotconf/security/kerberosencryptiontypes.xml +++ b/docs-xml/smbdotconf/security/kerberosencryptiontypes.xml @@ -37,15 +37,9 @@ </para> <para>When set to <constant>legacy</constant>, only RC4-HMAC-MD5 - is allowed. Avoiding AES this way has one a very specific use. - Normally, the encryption type is negotiated between the peers. - However, there is one scenario in which a Windows read-only domain - controller (RODC) advertises AES encryption, but then proxies the - request to a writeable DC which may not support AES encryption, - leading to failure of the handshake. Setting this parameter to - <constant>legacy</constant> would cause samba not to negotiate AES - encryption. It is assumed of course that the weaker legacy - encryption types are acceptable for the setup. + is allowed. AVOID using this option, because of + <ulink url="https://www.samba.org/samba/security/CVE-2022-37966.html">CVE-2022-37966</ulink> see + <ulink url="https://bugzilla.samba.org/show_bug.cgi?id=15237">https://bugzilla.samba.org/show_bug.cgi?id=15237</ulink>. </para> </description> |