The Samba Team reports:
An incomplete access check on dnsHostName allows
authenticated but otherwise unprivileged users to
delete this attribute from any object in the directory.
The Samba AD DC administration tool, when operating
against a remote LDAP server, will by default send
new or reset passwords over a signed-only connection.
The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for
CVE-2018-10919 Confidential attribute disclosure via
LDAP filters was insufficient and an attacker may be
able to obtain confidential BitLocker recovery keys
from a Samba AD DC.
Installations with such secrets in their Samba AD
should assume they have been obtained and need replacing.