FEDORA-2026-b16c9cbc0f — security update for 389-ds-base

stable

389-ds-base-3.2.3-5.fc44

FEDORA-2026-b16c9cbc0f created by vashirov a month ago for Fedora 44

Resolves: #2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [fedora-all]
Resolves: #2497652 CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [fedora-all]
Resolves: #2511796 CVE-2026-69152 389-ds-base: brace-expansion: Denial of Service via unbounded intermediate arrays [fedora-all]
Resolves: #2529450 CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN [fedora-all]
Resolves: #2529451 CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search [fedora-all]
Resolves: #2529452 CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() [fedora-all]
Resolves: #2494775 CVE-2026-11611 389-ds-base: 389-ds-base: Content Sync plugin unbounded queue growth and race conditions [fedora-all]
Resolves: #2494825 CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation [fedora-all]
Resolves: #2494894 CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service [fedora-all]
Resolves: #2494895 CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]
Resolves: #2509729 CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [fedora-all]
Resolves: #2513063 CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort CleanAllRUV replication maintenance [fedora-all]
Resolves: #2494827 CVE-2026-11793 389-ds-base: 389-ds-base: stack buffer overflow in checkPrefix() algorithm ID parsing [fedora-all]
Resolves: #2494830 CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string) [fedora-all]
Resolves: #2498023 CVE-2026-15041 389-ds-base: 389-ds-base: Non-constant-time comparison in PBKDF2-SHA256 password verification [fedora-all]

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2026-b16c9cbc0f

This update has been submitted for testing by vashirov.

a month ago

This update's test gating status has been changed to 'waiting'.

a month ago

This update's test gating status has been changed to 'waiting'.

a month ago

This update's test gating status has been changed to 'failed'.

a month ago

This update has been pushed to testing.

a month ago

vashirov edited this update.

New build(s):

389-ds-base-3.2.3-3.fc44

Removed build(s):

389-ds-base-3.2.3-2.fc44

Karma has been reset.

a month ago

This update has been submitted for testing by vashirov.

a month ago

This update's test gating status has been changed to 'waiting'.

a month ago

This update's test gating status has been changed to 'passed'.

a month ago

This update has been pushed to testing.

a month ago

vashirov edited this update.

New build(s):

389-ds-base-3.2.3-5.fc44

Removed build(s):

389-ds-base-3.2.3-3.fc44

Karma has been reset.

a month ago

This update has been submitted for testing by vashirov.

a month ago

This update's test gating status has been changed to 'failed'.

a month ago

This update's test gating status has been changed to 'waiting'.

a month ago

This update's test gating status has been changed to 'passed'.

a month ago

This update has been pushed to testing.

a month ago

This update has been submitted for stable by bodhi.

3 weeks ago

This update has been pushed to stable.

3 weeks ago

Please log in to add feedback.

Metadata

Type

security

Severity

urgent

Karma

Signed

Content Type

RPM

Test Gating

passed

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

14 days

Dates

submitted

a month ago

in testing

a month ago

in stable

3 weeks ago

modified

a month ago

approved

3 weeks ago

Builds

389-ds-base-3.2.3-5.fc44

BZ#2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [fedora-all]

BZ#2494775 CVE-2026-11611 389-ds-base: 389-ds-base: Content Sync plugin unbounded queue growth and race conditions [fedora-all]

BZ#2494825 CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation [fedora-all]

BZ#2494827 CVE-2026-11793 389-ds-base: 389-ds-base: stack buffer overflow in checkPrefix() algorithm ID parsing [fedora-all]

BZ#2494830 CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string) [fedora-all]

BZ#2494894 CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service [fedora-all]

BZ#2494895 CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]

BZ#2497652 CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [fedora-all]

BZ#2498023 CVE-2026-15041 389-ds-base: 389-ds-base: Non-constant-time comparison in PBKDF2-SHA256 password verification [fedora-all]

BZ#2509729 CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [fedora-all]

BZ#2511796 CVE-2026-69152 389-ds-base: brace-expansion: Denial of Service via unbounded intermediate arrays [fedora-all]

BZ#2513063 CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort CleanAllRUV replication maintenance [fedora-all]

BZ#2529450 CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN [fedora-all]

BZ#2529451 CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search [fedora-all]

BZ#2529452 CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() [fedora-all]

389-ds-base-3.2.3-5.fc44

Automated Test Results

passed

Test Cases


0	0	Test Case 389 Directory Server instance setup