Описание
Security update for 389-ds
This update for 389-ds fixes the following issues:
- CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).
- CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remote code execution (bsc#1279864).
- CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (bsc#1279572).
- CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865).
- CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated privileges to execute shell commands with root privileges on the directory server host (bsc#1279866).
- CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client to bypass access controls on directory entries containing empty SELFDN attributes (bsc#1279867).
- CVE-2026-86344: incomplete LDAP messages sent in rapid succession can cause worker thread exhaustion (bsc#1284028).
- CVE-2026-86345: smuggled plaintext commands sent alongside StartTLS requests can cause response forgery and authentication bypasses (bsc#1284034).
Update to version 2.2.11~git12.1e612cde2:
- Issue 7919 - CVE-2026-86344 - Fix worker pool exhaustion via partial LDAP messages (DoS)
- Issue 7921 - Fix StartTLS plaintext buffer handling (#7922) (#7947)
Update to version 2.2.11~git10.1f26fcebd:
- Issue 7912 - dsidm role create-filtered ignores --nsrolefilter and forces an interactive prompt (#7913)
- Issue 7908 - dsctl cockpit open-firewall --zone passes a malformed argument (#7909)
- Issue 7848 - Reject incomplete MD5 and GOST-YESCRYPT hashes (#7849)
- Issue 7837 - importing ldif with entry with long attribute name and subtype causes stack-buffer-overflow (#7838)
- Issue 6270 - heap-use-after-free with pwp dictionary path (#7791)
- Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7632) (#7854)
- iadvisories/GHSA-rgxx-hcc4-x3h4 / heap-buffer-overflow in rdn_av_swap (#7826)
- Migrate pwdchan to base64 0.23 Engine API
- Update rust-dependencies
Update to version 2.2.11~git1.98ee3aac7:
- Issue 7757 - stack-buffer-overflow caused by slapi_attr_init_syntax() (#7759)
- Bump version to 2.2.11
- Security fix for CVE-2026-76560
- Security fix for CVE-2026-19843
- Security fix for CVE-2026-18922
- Security fix for CVE-2026-18453
- Security fix for CVE-2026-18355
- Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs
- Fix expiration time check (#7718)
- Issue 7774 - Add backport action (#7775)
- Issue 7770 - Testimony failure in test_cleanruv_extop_security.py (#7771)
- Issue 1704 - Include stdbool.h in slapi headers on 2.4 (#7768)
- CVE-2026-11770 - Fix StartReplicationRequest auth gate response format
- Security fix for CVE-2026-11770
- Issue 3082 - Add test389.topologies compatibility shim for backports (#7725)
- Issue 7595 - Skip redundant CI runs to relieve the Actions queue (#7755)
- Issue 4701 - Fix UAF when excluding attrs from retro changelog (#7730)
- Issue 7723 - Range search returns an empty result when its start key is removed (#7724)
- Issue 7735 - Heap overflow when parsing objectclass superior (#7736)
- Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict (#7734)
- Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer (#7708)
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP5
Ссылки
- Link for SUSE-SU-2026:4932-1
- E-Mail link for SUSE-SU-2026:4932-1
- SUSE Security Ratings
- SUSE Bug 1273133
- SUSE Bug 1279572
- SUSE Bug 1279864
- SUSE Bug 1279865
- SUSE Bug 1279866
- SUSE Bug 1279867
- SUSE Bug 1284028
- SUSE Bug 1284034
- SUSE CVE CVE-2026-11770 page
- SUSE CVE CVE-2026-18355 page
- SUSE CVE CVE-2026-18453 page
- SUSE CVE CVE-2026-18922 page
- SUSE CVE CVE-2026-19843 page
- SUSE CVE CVE-2026-76560 page
- SUSE CVE CVE-2026-86344 page
- SUSE CVE CVE-2026-86345 page
Описание
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.
Затронутые продукты
Ссылки
- CVE-2026-11770
- SUSE Bug 1273133
Описание
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an encrypted_buffer_count below the already-consumed encrypted_buffer_offset, causing an unsigned subtraction underflow in sasl_io_read_packet(). PR_Recv is then requested to read approximately 4 GiB into a 1024-byte heap buffer, resulting in a heap buffer overflow with attacker-controlled content. After a successful SASL bind with integrity protection (SSF > 0), a remote authenticated attacker can cause a denial of service or potentially achieve remote code execution. This flaw is distinct from CVE-2026-11774, whose fix only guards against upper-bound overflow.
Затронутые продукты
Ссылки
- CVE-2026-18355
- SUSE Bug 1279864
Описание
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.
Затронутые продукты
Ссылки
- CVE-2026-18453
- SUSE Bug 1279572
Описание
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.
Затронутые продукты
Ссылки
- CVE-2026-18922
- SUSE Bug 1279865
Описание
A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.
Затронутые продукты
Ссылки
- CVE-2026-19843
- SUSE Bug 1279866
Описание
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.
Затронутые продукты
Ссылки
- CVE-2026-76560
- SUSE Bug 1279867
Описание
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.
Затронутые продукты
Ссылки
- CVE-2026-86344
- SUSE Bug 1284028
Описание
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in place of the client's own pending operation's response, due to messageID collision. This can cause a client application to treat a failed authentication (bind) attempt as successful.
Затронутые продукты
Ссылки
- CVE-2026-86345
- SUSE Bug 1284034