Denisonbarbosacommitted

**Name of the Vulnerable Software and Affected Versions** Canonical ADSys versions prior to v0.16.3 **Description** An issue exists during Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (internal/policies/certificate/python/vendor samba/gp/gp cert auto enroll ext.py). ADSys uses a plaintext HTTP connection instead of a secure HTTPS connection to request the CA certificate from the AD CS server through the `GetCACert` function. An unauthenticated network attacker positioned between the managed Ubuntu host and the configured AD CS CA hostname can perform a Man-in-the-Middle (MITM) attack—a technique where an attacker intercepts communication between two parties. By intercepting the request, the attacker can provide a malicious Root CA certificate, which the system automatically accepts and registers into the local system trust store via `update-ca-certificates`. This leads to system-wide trust store poisoning, allowing TLS clients to accept rogue certificates for any domain and enabling the decryption and interception of subsequent TLS connections. **Recommendations** Update to version v0.16.3.