security update for 389-ds-base

The 389 Directory Server (389-ds-base) contains several critical security flaws: CVE-2026-18355 is a heap buffer overflow caused by a SASL wrapped-record length lower-bound underflow in sasl_io_start_packet(). CVE-2026-18453 is a pre-authentication NULL pointer dereference triggered via paged results and USE_ONE_BACKEND control in op_shared_search. CVE-2026-18922 allows privilege escalation to Directory Manager through SASL PLAIN authentication by exploiting a stale identity in the Cyrus SASL auxiliary property. CVE-2026-76560 enables an anonymous LDAP client to bypass SELFDN ACI bind-rule checks using an empty bind DN. These vulnerabilities are addressed in updated 389-ds-base packages provided by Red Hat for RHEL 8.4 Extended Life Cycle and AUS variants.

Successful exploitation of these vulnerabilities could lead to denial of service (via NULL pointer dereference), privilege escalation to Directory Manager, and bypass of access control checks, potentially compromising the confidentiality, integrity, and availability of the directory server. The heap buffer overflow could also lead to arbitrary code execution or crashes. These impacts are critical given the role of the directory server in authentication and authorization.

A security update is available from Red Hat that addresses all listed vulnerabilities in 389-ds-base. Users should apply the updated packages for Red Hat Enterprise Linux 8.4 Extended Life Cycle Long Life and AUS variants as provided in Red Hat Advisory RHSA-2026:64789. Refer to https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation steps are indicated beyond applying the official update.