Created attachment 18904 [details] possible fix
Created attachment 18906 [details] Initial advisory, CVE number pending
Created attachment 18907 [details] Advisory
Created attachment 18908 [details] Patch for 4.21
Created attachment 18909 [details] Patch for 4.22
Created attachment 18910 [details] Patch for 4.23
Created attachment 18911 [details] Patch for 4.24
Created attachment 18912 [details] Patch for master I've run a full CI on master only, I've compiled all the other ones.
Created attachment 18914 [details] Advisory with CVE number and vl credit. Advisory looks good. I have added the CVE number and an acknowledgement for Volker.
If the username contains spaces or tabs, the script will still get an unexpected number of arguments. Is this going to matter?
the security release that was scheduled for tomorrow, will be postponed due to new problems that have been identified with one of the fixes. We will announce a new release date as soon as possible after the remaining issues have been ruled out.
This returns NT_STATUS_INVALID_USER_PRINCIPAL_NAME for valid usernames e.g with a '-'
See https://bugzilla.samba.org/attachment.cgi?id=18962 for the current work in progress patches.
I think STRING_SUB_UNSAFE_CHARACTERS should include & $ echo foo & bang [1] 48145 foo bash: bang: command not found... [1]+ Done echo foo Is there a definitive list of shell meta-characters?
(In reply to Andrew Bartlett from comment #14) https://www.gnu.org/software/bash/manual/html_node/Definitions.html#index-control-operator
https://www.gnu.org/software/bash/manual/html_node/Definitions.html#index-metacharacter
Created attachment 18970 [details] CVE-2026-4408-advisory.txt The updated advisory. The current patches are on https://bugzilla.samba.org/show_bug.cgi?id=16033
(In reply to Andrew Bartlett from comment #14) STRING_SUB_UNSAFE_CHARACTERS is this at the end: "$`\"';%|&<>"
Created attachment 18976 [details] CVE-2026-4408-metze-03-advisory.txt change CVE to 10.0 as not privileges are required
Again the patches are on https://bugzilla.samba.org/show_bug.cgi?id=16033
Minor typo: "singles quotes" → "single quotes"
Created attachment 18986 [details] CVE-2026-4408-metze-04-advisory.txt additional fix: nt4 DC wasn't mentioned in the summary
Scheduled release date is now 2026-05-26.
I plan to upload the releases in about 3 hours from now...
This bug was referenced in samba v4-24-stable (Release samba-4.24.3): cd547290531955e5d04c7a8e7721d80f3678fad8 4b12c0378ef5f743aa2147294c004f21edb43b98 9e6d67c23199de70a1909610e13cf460b028a031 295b0bb2fadfe090e1f7dfb61c444d127c86edac 13528178b4895f1434a67b32575477a0d57a4c9f 2c463b0f12b300b9e66a4c08cfef31631ce1cc0c 9a60afd3e3146a78a59912402bc870b8d156b26f aa5a4480353f73d39e40c6ca558c1370c1e567c6 52ed5933c6211c08f1e3a1144ac6b8d3a9ab8261 75f0d818bc64d2e1994bf4ac1b18dcfb1aa96e3a 989346601ef5310a933a0e7fb9cd6f30b2b23803 b74d583da51c68b7197831dbbb734c8d3e82eef1 d65c9dc9a7e49141e54c904e2c744f8c83a79959 89f5dfb04f3dc04489744961725d5ee5e1c9424c b1d63d6ca1a9b495d6c173009e479194fa8f3e23 fd1b4c1e570e1606dd15c2a4726ba4c626b392b4 19c70403ee0bce296f22cb8dc0b304c75b7dd30a 79b88dc17628cc741594a4a55dc54e270b1d5c25
This bug was referenced in samba v4-23-stable (Release samba-4.23.8): df3455cf6d7e0f678de194941955ee0fde340287 db426990a137db31e6865bf3ae581ea3543c32a5 fd5f6d69409ff1d4f99de9c8f1d2af16bb99971f b54d65606c84b3da3ba83f53db71a69667402cf0 0c13febc7f40e512356afeea9e03d15de8ffba39 9374f35a1be538f1330b9b6da2248e7a22810983 20ba81c29f97a9a819157b3fb671a222f6ebef46 62d75721bcf2b0f8b3681ed60eaffe7a4c740c3e 20fcc1380b1693b8ce1677dd224a8d556223d213 6f9febc25552091a98b8c0bb9e94b206b1692fe0 9e7b5f0a5687b993fd5a6303c0414a80a206b531 14b16002a126f0384a72f6ddf8be9a1dce68efe5 d1c6fc6e991d0a6080eba00cf5e2b6782578306d 9a77a1c678c6f3d56e957fd57b276c68c9bdaf7c 94133ecf9ccf6bfcc449f443e2d71d62450c05b1 57e21c3478734559cc9af04dae6ce67423c17563 132a5634d44579f71fd2bc9fcd69615cf3239bff 902436a3438de6d8f77cf9b118493921e3d088b5
This bug was referenced in samba v4-22-stable (Release samba-4.22.10): 26b64ec55944b375ead223a214c5f4301329511f 76dcb30911c22d92ca79e9034656b691a2d51df4 3032b7efe9d2fd35081ec33d575d01f9ebf6725c 3f24236a5000402de11d973527eb7d28fd30de19 113ba24197ca4e5bd683951f99fa4553a4240e48 c4a93471622e5d7f8e28073029f3ebfbe22b6288 003ff9b49f65d8006330a018da6fe0169a6fdb48 5551dd76e92480625f00765f183d753dcb857894 0cabcbd24cf2eec692b1a9642447e81c97cc90b7 d291377ac1ea515ac064ac00d59e1787db5671d1 ebd4edda32d949e10e531939b7a4e19b2306ff64 6dce1833a5d27f82a9b133601ce7f749f3be08ec 8f28ca0b8abccf30f479133cc78f9a72500ab366 1c5146ddfc736e9d790bd91f3124c6fba6847bb3 67ad724e22f3724d5e07eaa8f25eb527aa417599 266cd3dc063fdb88a0d0468e8d6f85d6abdecc04 65a9ac413b03eefc7a48d5536e54177319ca30e3 640f18d1a642264a9777f933dfaae78db6918a5f
This bug was referenced in samba v4-24-test (Release samba-4.24.3): cd547290531955e5d04c7a8e7721d80f3678fad8 4b12c0378ef5f743aa2147294c004f21edb43b98 9e6d67c23199de70a1909610e13cf460b028a031 295b0bb2fadfe090e1f7dfb61c444d127c86edac 13528178b4895f1434a67b32575477a0d57a4c9f 2c463b0f12b300b9e66a4c08cfef31631ce1cc0c 9a60afd3e3146a78a59912402bc870b8d156b26f aa5a4480353f73d39e40c6ca558c1370c1e567c6 52ed5933c6211c08f1e3a1144ac6b8d3a9ab8261 75f0d818bc64d2e1994bf4ac1b18dcfb1aa96e3a 989346601ef5310a933a0e7fb9cd6f30b2b23803 b74d583da51c68b7197831dbbb734c8d3e82eef1 d65c9dc9a7e49141e54c904e2c744f8c83a79959 89f5dfb04f3dc04489744961725d5ee5e1c9424c b1d63d6ca1a9b495d6c173009e479194fa8f3e23 fd1b4c1e570e1606dd15c2a4726ba4c626b392b4 19c70403ee0bce296f22cb8dc0b304c75b7dd30a 79b88dc17628cc741594a4a55dc54e270b1d5c25
This bug was referenced in samba v4-23-test (Release samba-4.23.8): df3455cf6d7e0f678de194941955ee0fde340287 db426990a137db31e6865bf3ae581ea3543c32a5 fd5f6d69409ff1d4f99de9c8f1d2af16bb99971f b54d65606c84b3da3ba83f53db71a69667402cf0 0c13febc7f40e512356afeea9e03d15de8ffba39 9374f35a1be538f1330b9b6da2248e7a22810983 20ba81c29f97a9a819157b3fb671a222f6ebef46 62d75721bcf2b0f8b3681ed60eaffe7a4c740c3e 20fcc1380b1693b8ce1677dd224a8d556223d213 6f9febc25552091a98b8c0bb9e94b206b1692fe0 9e7b5f0a5687b993fd5a6303c0414a80a206b531 14b16002a126f0384a72f6ddf8be9a1dce68efe5 d1c6fc6e991d0a6080eba00cf5e2b6782578306d 9a77a1c678c6f3d56e957fd57b276c68c9bdaf7c 94133ecf9ccf6bfcc449f443e2d71d62450c05b1 57e21c3478734559cc9af04dae6ce67423c17563 132a5634d44579f71fd2bc9fcd69615cf3239bff 902436a3438de6d8f77cf9b118493921e3d088b5
This bug was referenced in samba v4-22-test (Release samba-4.22.10): 26b64ec55944b375ead223a214c5f4301329511f 76dcb30911c22d92ca79e9034656b691a2d51df4 3032b7efe9d2fd35081ec33d575d01f9ebf6725c 3f24236a5000402de11d973527eb7d28fd30de19 113ba24197ca4e5bd683951f99fa4553a4240e48 c4a93471622e5d7f8e28073029f3ebfbe22b6288 003ff9b49f65d8006330a018da6fe0169a6fdb48 5551dd76e92480625f00765f183d753dcb857894 0cabcbd24cf2eec692b1a9642447e81c97cc90b7 d291377ac1ea515ac064ac00d59e1787db5671d1 ebd4edda32d949e10e531939b7a4e19b2306ff64 6dce1833a5d27f82a9b133601ce7f749f3be08ec 8f28ca0b8abccf30f479133cc78f9a72500ab366 1c5146ddfc736e9d790bd91f3124c6fba6847bb3 67ad724e22f3724d5e07eaa8f25eb527aa417599 266cd3dc063fdb88a0d0468e8d6f85d6abdecc04 65a9ac413b03eefc7a48d5536e54177319ca30e3 640f18d1a642264a9777f933dfaae78db6918a5f
This bug was referenced in samba master: 45431b969e1831d75ca2d16c916fa5f374af8490 93c98023f51db8c2d2db306030f6bc25a88677fd bd05bcd18a0c6234d9dfe39b1811b80110597aac 094852887ae6825fe18715133d272a445978bfa4 73231db51394399861394966e31e91e461954320 f6a9447df1c4e5018539ed847427921e8830517c 82900145139730249fe8f585a242e7dff8bf3e66 c51b42fae63ec6466c4736cdc9ddbd55782614bb 88c45db50d2289afd750ca25f2acf9ed4ceb9819 c610d8c6b1ef0e9871077eb40e79c5e1ed610a5a b6fe311a6ac46bb6cd3af6fdfb5b21c7397069d5 9910bbfc09ba35cf4ea82ff92a9f94de9f5bc862 e6c532fbd577ad01ce39f6480afcea627c68b196 23bc9e264e253c951e5e2e85cd7d8659e3c46560 a54ef87bcdb36b53b8cb04c2cf3ddf2c9e559ce6 288b82f7da96d2362e14582e8b090e926289b2ba a4b214e799b74124f186c7da22e085d43e604cec 2d699a70083047c722d3b307a01aa473431ed7c3