CLSA-2026-1777945598
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777945598.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1777945598
- Upstream
- Published
- 2026-05-05T01:46:44Z
- Modified
- 2026-06-04T09:47:11.027449363Z
- Summary
- Fix CVE(s): CVE-2020-25717, CVE-2020-25719, CVE-2020-25722
- Details
-
- SECURITY UPDATE: domain user can become root on a domain member by
renaming a machine account
- debian/patches/CVE-2020-25717.patch: backport the el6/ol6 8-commit subset (samba 3.6.23 precedent); introduce the new "min domain uid" smb.conf parameter (default 1000) and enforce it in checkaccount() so a domain logon resolving to a uid below the threshold is rejected with NTSTATUSINVALIDTOKEN, drop the DOMAIN\user to user prefix-stripping fallback in smbgetpwnam(), stop autocreating local users from checkaccount() and from the kerberos guest fallback by passing create=false, drop the !winbindping() branch in createlocaltoken() so a missing winbindd no longer silently switches the unix-token computation, and require a PAC in any domain mode (DC or member) inside gensecgeneratesessioninfopac() returning NTSTATUSNOIMPERSONATION_TOKEN otherwise (the gensec hunk is the jointly tagged CVE-2020-25717+CVE-2020-25719 commit, so this update also delivers the member-server portion of CVE-2020-25719; the DC-side portion of CVE-2020-25719 is tracked separately under ELSCVE-104393)
- CVE-2020-25717
- SECURITY UPDATE: privileged attribute escalation and structural
objectclass change in active directory ldap server
- debian/patches/CVE-2020-25722.patch: in source4/dsdb/samdb/ldbmodules/objectclass.c, capture the current structural objectclass at the start of objectclassdomod and reject any modify that would change it; in source4/dsdb/samdb/ldbmodules/samldb.c, factor the domain ntSecurityDescriptor lookup into samldbgetdomainsecdesc() and add samldbchecksensitiveattributes() invoked from samldbadd() and samldbmodify() to refuse non-system writes to sidHistory, gate msDS-SecondaryKrbTgtNumber on the DS-Install-Replica extended right, and gate msDS-AllowedToDelegateTo on SePrivEnableDelegation
- CVE-2020-25722
- SECURITY UPDATE: domain user can become root on a domain member by
renaming a machine account
- References