Red Hat Security Advisory: 389-ds:1.4 security, bug fix, and enhancement update

The Red Hat 389 Directory Server 1.4 update addresses four critical security vulnerabilities: CVE-2026-18355 is a heap buffer overflow caused by a SASL wrapped-record length lower-bound underflow in sasl_io_start_packet(); CVE-2026-18453 is a pre-authentication NULL pointer dereference triggered via paged results and USE_ONE_BACKEND control in op_shared_search; CVE-2026-18922 allows privilege escalation to Directory Manager through SASL PLAIN authentication due to a stale identity in the Cyrus SASL auxiliary property; CVE-2026-76560 enables an anonymous LDAP client to bypass SELFDN ACI bind-rule checks using an empty bind DN. These vulnerabilities are fixed in the updated 389-ds-base packages provided for Red Hat Enterprise Linux 8.8. Additional bug fixes improve replication initialization and configuration handling.

Successful exploitation of these vulnerabilities could lead to denial of service (via NULL pointer dereference), privilege escalation to Directory Manager, and bypass of access control checks in the LDAP server. The heap buffer overflow could potentially allow memory corruption. These issues collectively pose a critical risk to the confidentiality, integrity, and availability of the affected directory services.

Red Hat has released updated 389-ds-base packages for Red Hat Enterprise Linux 8.8 that address these vulnerabilities. Users should apply these official patches promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided update.