Описание
Security update for 389-ds
This update for 389-ds fixes the following issues:
- CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (bsc#1268298).
- CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure (bsc#1268065).
- CVE-2026-11786: lack of length check can cause an out-of-bound read (bsc#1268064).
- CVE-2026-11791: schema reload triggered during concurrent LDAP query traffic can lead to a use-after-free (bsc#1268047).
Changes for 389-ds:
- Update to version 2.7.0~git234.0afa2e38b:
- Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713)
- Issue 7688 - BUG - partial address leak in sso token (#7689)
- Issue 7705 - With memberOfEntryScope set, deferred memberOf skips MODIFY operations (#7706)
- Issue 7714 - UI - sass import rules are deprecated
- Issue 7658 - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND
- Issue 7710 - MemberOf deferred update - Use condvar instead of sleep loop
- Issue 7637 - fix cherry-pick error
- Issue 7637 - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload
- Issue 7578 - schema - attribute refcount is not maintained properly
- Issue 7605 - Harden CI test ports against ephemeral allocation (#7692)
- Issue 7528 - Retry the CI image pull instead of failing the job (#7691)
- Issue 7460 - MOD_REPLACE on groups/link attributes modifies overlap targets (#7461)
- Issue 7670 - BDB range searches intermittently fail with err=1 under write load (#7671)
- Issue 7108 - Fix shutdown crash in entry cache destruction (#7163)
- Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7662)
- Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value (#7608)
- Issue 7519 - Ignore obsolete entrydn index when entryrdn is enabled (#7526)
- Issue 7611 - Preserve legacy PBKDF2 hash compatibility (#7649)
- Issue 7547 - Heap buffer overflow in ldap_utf8prev()
- Issue 7611 - PBKDF2 password verification should reject invalid iteration count (#7613)
- Issue 7558 - Total init sends the suffix entry twice (#7640)
- Issue 7635 - Integer Underflow in {SMD5} Password Comparison (#7636)
Список пакетов
SUSE Linux Enterprise Module for Server Applications 15 SP7
Ссылки
- Link for SUSE-SU-2026:3678-1
- E-Mail link for SUSE-SU-2026:3678-1
- SUSE Security Ratings
- SUSE Bug 1268047
- SUSE Bug 1268064
- SUSE Bug 1268065
- SUSE Bug 1268298
- SUSE CVE CVE-2026-11774 page
- SUSE CVE CVE-2026-11785 page
- SUSE CVE CVE-2026-11786 page
- SUSE CVE CVE-2026-11791 page
Описание
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.
Затронутые продукты
Ссылки
- CVE-2026-11774
- SUSE Bug 1268298
- SUSE Bug 1271913
Описание
A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.
Затронутые продукты
Ссылки
- CVE-2026-11785
- SUSE Bug 1268065
Описание
A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during database import, causing an out-of-bounds read detectable under memory instrumentation.
Затронутые продукты
Ссылки
- CVE-2026-11786
- SUSE Bug 1268064
Описание
A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees attribute syntax information nodes, bypassing the refcount-based deferred deletion used elsewhere in the attribute syntax subsystem. If an administrator triggers schema reload while concurrent LDAP query traffic is active, worker threads may access freed memory, resulting in use-after-free or double-free and a denial of service (server crash).
Затронутые продукты
Ссылки
- CVE-2026-11791
- SUSE Bug 1258727
- SUSE Bug 1268047