openSUSE has issued an advisory on February 18: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WXCOTOTL4ZIZB65QEGM65YZZILOED4A3/ The issues are fixed upstream in 1.2.0: https://github.com/gssapi/gss-ntlmssp/releases/tag/v1.2.0 https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-jjjx-5qf7-9mgf https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-r85x-q5px-9xfq https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-7q7f-wqcg-mvfg https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-mfm4-6g58-jw74 https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-24pf-6prf-24ch Mageia 8 is also affected.
Status comment: (none) => Fixed upstream in 1.2.0Whiteboard: (none) => MGA8TOO
Done for mga8 and Cauldron!
CC: (none) => geiger.david68210
Thanks for instant fix, DavidG. Assigning to you, assuming you will quickly pass it - with advisory - to QA for M8.
Assignee: bugsquad => geiger.david68210CC: geiger.david68210 => (none)
gssntlmssp-devel-1.2.0-1.mga8 gssntlmssp-1.2.0-1.mga8 from gssntlmssp-1.2.0-1.mga8.src.rpm
Assignee: geiger.david68210 => qa-bugsCC: (none) => geiger.david68210Version: Cauldron => 8Whiteboard: MGA8TOO => (none)Status comment: Fixed upstream in 1.2.0 => (none)
$ urpmq -i gssntlmssp [...] Summary : GSSAPI NTLMSSP Mechanism Just a FYI. Sounds like developer country: General Security Services API No idea how to test this but it updates cleanly.
CC: (none) => tarazed25
I think this can be tested with SAMBA in server mode, acting as NT4 Server The SAMBA configured as AD, may be can be used to test trying to connect from M$ desktop not joined to domain
CC: (none) => neoser10
MGA8-64 MATE on Acer Aspire 5253 No installation issues. No previous updates, so trying to find something # urpmq --whatrequires gssntlmssp gssntlmssp # urpmq --whatrequires-recursive gssntlmssp gssntlmssp Not very helpfull, so trying to do something along the line suggested by Mauricio, but that takes more time......
CC: (none) => herman.viaene
Looking for guidance found https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller Reading this, I make the conclusion that that would take me at least a day to study and try/fail cycles to get this working. I don't have that time today or tomorrow. So, up to the higher powers to decide, but as Len I wouldn't object to an OK based on clean install and no ill effects on usual networking.
When our two most experienced QA testers both say a clean update should be enough, we should listen to them. Sorry it took me so long, guys. Validating.
Whiteboard: (none) => MGA8-64-OKCC: (none) => andrewsfarm, sysadmin-bugsKeywords: (none) => validated_update
Keywords: (none) => advisoryCC: (none) => davidwhodgins
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2023-0108.html
Status: NEW => RESOLVEDResolution: (none) => FIXED