Skip to content
Heist/ feed
UnratedFix available

Security update for 389-ds

Type: advisorySource: OSV1 source record

This update for 389-ds fixes the following issues: - CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133). - CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remote code execution (bsc#1279864). - CVE-2026-18453: 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (bsc#1279572). - CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865). - CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated privileges to execute shell commands with root privileges on the directory server host (bsc#1279866). - CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client to bypass access controls on directory entries containing empty SELFDN attributes (bsc#1279867). Changes for 389-ds: - Update to version 2.8 LTS (jsc#PED-16949). - Update to version 2.8.2~git10.030ada7a6: * Issue 6596 - BUG - Compilation Regresion (#6597) (#7866) * Issue 7627 - When it exists configured matching rule for an (#7628) * [Backport 389-ds-base-2.8] Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7852) * iadvisories/GHSA-rgx

Announced Source revision 1
Original source ↗

SUSE-SU-2026:4380-1

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:SUSE-SU-2026:4380-1

389-ds

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
2.8.2~git10.030ada7a6-150700.3.25.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.8.2~git10.030ada7a6-150700.3.25.1"
          }
        ]
      }
    ],
    "package": {
      "name": "389-ds",
      "purl": "pkg:rpm/suse/389-ds&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7",
      "ecosystem": "SUSE:Linux Enterprise Module for Server Applications 15 SP7"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4380-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "389-ds": "2.8.2~git10.030ada7a6-150700.3.25.1",
          "lib389": "2.8.2~git10.030ada7a6-150700.3.25.1",
          "libsvrcore0": "2.8.2~git10.030ada7a6-150700.3.25.1",
          "389-ds-devel": "2.8.2~git10.030ada7a6-150700.3.25.1"
        }
      ]
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#25912 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement