Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:2316-1

Опубликовано: 09 июн. 2026
Источник: suse-cvrf

Описание

Security update for 389-ds

This update for 389-ds fixes the following issue

  • CVE-2026-9064: unbounded LDAP controls count in get_ldapmessage_controls_ext() can lead to amplified CPU time and heap allocation and a denial of service (bsc#1265898).

Changes for 389-ds:

  • Update to version 2.0.20~git90.9f70d434e.

Список пакетов

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
389-ds-2.0.20~git90.9f70d434e-150400.3.51.1
389-ds-devel-2.0.20~git90.9f70d434e-150400.3.51.1
lib389-2.0.20~git90.9f70d434e-150400.3.51.1
libsvrcore0-2.0.20~git90.9f70d434e-150400.3.51.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
389-ds-2.0.20~git90.9f70d434e-150400.3.51.1
389-ds-devel-2.0.20~git90.9f70d434e-150400.3.51.1
lib389-2.0.20~git90.9f70d434e-150400.3.51.1
libsvrcore0-2.0.20~git90.9f70d434e-150400.3.51.1
SUSE Linux Enterprise Server 15 SP4-LTSS
389-ds-2.0.20~git90.9f70d434e-150400.3.51.1
389-ds-devel-2.0.20~git90.9f70d434e-150400.3.51.1
lib389-2.0.20~git90.9f70d434e-150400.3.51.1
libsvrcore0-2.0.20~git90.9f70d434e-150400.3.51.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4
389-ds-2.0.20~git90.9f70d434e-150400.3.51.1
389-ds-devel-2.0.20~git90.9f70d434e-150400.3.51.1
lib389-2.0.20~git90.9f70d434e-150400.3.51.1
libsvrcore0-2.0.20~git90.9f70d434e-150400.3.51.1

Ссылки

Описание

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:389-ds-2.0.20~git90.9f70d434e-150400.3.51.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:389-ds-devel-2.0.20~git90.9f70d434e-150400.3.51.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:lib389-2.0.20~git90.9f70d434e-150400.3.51.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libsvrcore0-2.0.20~git90.9f70d434e-150400.3.51.1
Ссылки