Amazon Linux 2023 Security Advisory: ALAS2023-2026-1899
Advisory Released Date: 2026-07-07
Advisory Updated Date: 2026-07-07
Severity:
Important
Issue Overview:
If the certificate auto-enrollment GPO is enabled on domain members
(both in Samba's smb.conf and using Windows GPME tool), a CA
certificate may be fetched using a plain HTTP connection and installed
in the member computer's trust store. This may give an attacker a
chance to intercept the response, installing their chosen certificate
instead.
The URL from which the certificate is fetched follows a pattern used
by Microsoft's Network Device Enrollment Service (NDES) to provide
certificates to computers on the network that are not full domain
members. Domain members should already have access to these
certificates via better protected LDAP connections, so do not need the
NDES link (Samba uses no other part of NDES).
Pure Samba domains will not have auto-enrolment available, either
through LDAP or HTTP, as Samba does not currently implement Active
Directory Certificate Services. However, members of these domains are
still vulnerable if the GPO is enabled.
The patch removes the attempt to download the certificate and relies
on the LDAP values. (CVE-2026-3012)
Affected Packages:
samba
Issue Correction:
Run dnf update samba --releasever 2023.12.20260706 or dnf update --advisory ALAS2023-2026-1899 --releasever 2023.12.20260706 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
samba-ldb-ldap-modules-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-client-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
libwbclient-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-winbind-clients-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-common-libs-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
libnetapi-devel-4.17.12-1.amzn2023.0.5.aarch64
samba-krb5-printing-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
libsmbclient-devel-4.17.12-1.amzn2023.0.5.aarch64
python3-samba-dc-4.17.12-1.amzn2023.0.5.aarch64
samba-test-4.17.12-1.amzn2023.0.5.aarch64
samba-usershares-4.17.12-1.amzn2023.0.5.aarch64
samba-client-4.17.12-1.amzn2023.0.5.aarch64
samba-krb5-printing-4.17.12-1.amzn2023.0.5.aarch64
samba-dcerpc-4.17.12-1.amzn2023.0.5.aarch64
samba-vfs-iouring-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-common-tools-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-common-tools-4.17.12-1.amzn2023.0.5.aarch64
samba-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-client-libs-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-debugsource-4.17.12-1.amzn2023.0.5.aarch64
python3-samba-test-4.17.12-1.amzn2023.0.5.aarch64
samba-dc-libs-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-devel-4.17.12-1.amzn2023.0.5.aarch64
samba-winbind-4.17.12-1.amzn2023.0.5.aarch64
samba-ldb-ldap-modules-4.17.12-1.amzn2023.0.5.aarch64
samba-winbind-modules-4.17.12-1.amzn2023.0.5.aarch64
samba-winbind-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-winbind-clients-4.17.12-1.amzn2023.0.5.aarch64
samba-winbind-modules-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-tools-4.17.12-1.amzn2023.0.5.aarch64
python3-samba-4.17.12-1.amzn2023.0.5.aarch64
python3-samba-devel-4.17.12-1.amzn2023.0.5.aarch64
libwbclient-devel-4.17.12-1.amzn2023.0.5.aarch64
python3-samba-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-test-libs-4.17.12-1.amzn2023.0.5.aarch64
libnetapi-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
libsmbclient-4.17.12-1.amzn2023.0.5.aarch64
samba-dcerpc-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-libs-4.17.12-1.amzn2023.0.5.aarch64
samba-common-libs-4.17.12-1.amzn2023.0.5.aarch64
samba-4.17.12-1.amzn2023.0.5.aarch64
samba-test-libs-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-winbind-krb5-locator-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-winbind-krb5-locator-4.17.12-1.amzn2023.0.5.aarch64
libnetapi-4.17.12-1.amzn2023.0.5.aarch64
python3-samba-dc-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-vfs-iouring-4.17.12-1.amzn2023.0.5.aarch64
samba-test-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
libwbclient-4.17.12-1.amzn2023.0.5.aarch64
samba-dc-libs-4.17.12-1.amzn2023.0.5.aarch64
libsmbclient-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-libs-debuginfo-4.17.12-1.amzn2023.0.5.aarch64
samba-client-libs-4.17.12-1.amzn2023.0.5.aarch64
noarch:
samba-common-4.17.12-1.amzn2023.0.5.noarch
samba-pidl-4.17.12-1.amzn2023.0.5.noarch
src:
samba-4.17.12-1.amzn2023.0.5.src
x86_64:
libnetapi-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-client-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
libsmbclient-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
python3-samba-devel-4.17.12-1.amzn2023.0.5.x86_64
samba-debugsource-4.17.12-1.amzn2023.0.5.x86_64
python3-samba-dc-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-tools-4.17.12-1.amzn2023.0.5.x86_64
samba-test-4.17.12-1.amzn2023.0.5.x86_64
samba-dcerpc-4.17.12-1.amzn2023.0.5.x86_64
python3-samba-4.17.12-1.amzn2023.0.5.x86_64
samba-krb5-printing-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-vfs-iouring-4.17.12-1.amzn2023.0.5.x86_64
samba-krb5-printing-4.17.12-1.amzn2023.0.5.x86_64
libsmbclient-devel-4.17.12-1.amzn2023.0.5.x86_64
samba-test-libs-4.17.12-1.amzn2023.0.5.x86_64
libwbclient-devel-4.17.12-1.amzn2023.0.5.x86_64
samba-common-tools-4.17.12-1.amzn2023.0.5.x86_64
samba-dc-libs-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-winbind-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-test-libs-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-ldb-ldap-modules-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-winbind-clients-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-winbind-krb5-locator-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-usershares-4.17.12-1.amzn2023.0.5.x86_64
samba-common-libs-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-vfs-iouring-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-devel-4.17.12-1.amzn2023.0.5.x86_64
samba-dcerpc-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-winbind-modules-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
libwbclient-4.17.12-1.amzn2023.0.5.x86_64
libwbclient-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
libnetapi-devel-4.17.12-1.amzn2023.0.5.x86_64
samba-common-tools-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-test-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-libs-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
samba-winbind-krb5-locator-4.17.12-1.amzn2023.0.5.x86_64
samba-4.17.12-1.amzn2023.0.5.x86_64
samba-client-libs-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
python3-samba-debuginfo-4.17.12-1.amzn2023.0.5.x86_64
python3-samba-test-4.17.12-1.amzn2023.0.5.x86_64
libsmbclient-4.17.12-1.amzn2023.0.5.x86_64
samba-dc-libs-4.17.12-1.amzn2023.0.5.x86_64
samba-ldb-ldap-modules-4.17.12-1.amzn2023.0.5.x86_64
samba-client-4.17.12-1.amzn2023.0.5.x86_64
libnetapi-4.17.12-1.amzn2023.0.5.x86_64
samba-common-libs-4.17.12-1.amzn2023.0.5.x86_64
samba-winbind-modules-4.17.12-1.amzn2023.0.5.x86_64
samba-libs-4.17.12-1.amzn2023.0.5.x86_64
python3-samba-dc-4.17.12-1.amzn2023.0.5.x86_64
samba-winbind-4.17.12-1.amzn2023.0.5.x86_64
samba-winbind-clients-4.17.12-1.amzn2023.0.5.x86_64
samba-client-libs-4.17.12-1.amzn2023.0.5.x86_64