RHSA-2022:0133HighCVSS 8.1

Red Hat Security Advisory: Red Hat Virtualization Host security and bug fix update [ovirt-4.4.9] Async #2

Published
January 12, 2022
Last Modified
November 5, 2026

🔗 CVE IDs covered (1)

CVE-2020-25717 →

📋 Description

CVE-2020-25717 — samba: Active Directory (AD) domain user could become root on domain members

🎯 Affected products8

  • RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • Red Hat Virtualization 4 Hypervisor for RHEL 8
  • redhat-release-virtualization-host-0:4.4.9-4.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • redhat-release-virtualization-host-0:4.4.9-4.el8ev.x86_64 as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • redhat-release-virtualization-host-content-0:4.4.9-4.el8ev.x86_64 as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • redhat-virtualization-host-0:4.4.9-202201072228_8.5.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • redhat-virtualization-host-image-update-0:4.4.9-202201072228_8.5.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • redhat-virtualization-host-image-update-placeholder-0:4.4.9-4.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891 Workaround: Setting "gensec:require_pac=true" in the smb.conf makes, due to a cache prime in winbind, the DOMAIN\user lookup succeed, provided nss_winbind is in use, 'winbind use default domain = no' (the default) and no error paths are hit. It would be prudent to pre-create disabled users in Active Directory matching on all privileged names not held in Active Directory, eg ~~~ samba-tool user add root -H ldap://$SERVER -U$USERNAME%$PASSWORD --random-password samba-tool user add ubuntu -H ldap://$SERVER -U$USERNAME%$PASSWORD --random-password ~~~ (repeat for eg all system users under 1000 in /etc/passwd or special to any other AD-connected services, eg perhaps "admin" for a web-app)

🔗 References (5)