* SECURITY UPDATE: integer overflows in Heimdal PAC parsing allow remote code execution on 32-bit platforms and denial of service elsewhere - debian/patches/CVE-2022-42898.patch: catch the overflows that result from adding PAC_INFO_BUFFER_SIZE when parsing a PAC, and add the 64-bit store/retrieve helpers the checks need - CVE-2022-42898 * SECURITY UPDATE: an AD DC accepts a PAC whose contents were tampered with, because the KDC does not verify a checksum over the whole ticket - debian/patches/CVE-2022-37967.patch: add the new PAC ticket checksum and verify it in the KDC and in the PAC validation paths - CVE-2022-37967 * SECURITY UPDATE: an unprivileged user can write the dNSHostName attribute of a computer account without the Validated-DNS-Host-Name right - debian/patches/CVE-2022-32743.patch: validate dNSHostName and servicePrincipalName writes in the acl module and connect to samdb as the workstation account in the netlogon server - CVE-2022-32743 * SECURITY UPDATE: the netlogon secure channel accepts weak RC4/HMAC-MD5 crypto and unsealed traffic, allowing elevation of privilege - debian/patches/CVE-2022-38023.patch: default 'reject md5 clients' and 'reject md5 servers' to yes, add 'server schannel require seal [:COMPUTERACCOUNT]' (default yes) and route every netr_LogonSamLogon* variant through the schannel check in both netlogon servers - CVE-2022-38023 * SECURITY UPDATE: an AD DC can be forced to issue rc4-hmac Kerberos tickets and session keys even where stronger encryption is available - debian/patches/CVE-2022-37966.patch: announce PA-SUPPORTED-ETYPES, select session keys from the server's supported types and add the 'kdc supported enctypes', 'kdc default domain supportedenctypes' and 'kdc force enable rc4 weak session keys' options - debian/patches/CVE-2022-37966-domain-trust-modify.patch: add 'samba-tool domain trust modify' so an existing RC4-only trust can be repaired - CVE-2022-37966