Threats affecting pkg:rpm/redhat/389-ds-base

Multiple critical security vulnerabilities have been identified and fixed in the 389 Directory Server (389-ds-base) package for Red Hat Enterprise Linux 9.4. These include a heap buffer overflow, a pre-authentication NULL pointer dereference, privilege escalation via SASL PLAIN authentication, and bypass of bind-rule checks by anonymous LDAP clients. The update addresses these issues and includes additional bug fixes and enhancements.

A command injection vulnerability (CVE-2026-19843) exists in the 389-ds-base component of Red Hat Directory Server 12.6 EUS and 12.8 for RHEL 9. The issue arises from improper input handling of an unescaped LDAP Distinguished Name (DN) in the Cockpit 389 Console LDAP editor, allowing arbitrary command injection. Red Hat has released security updates to address this vulnerability.

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An unauthenticated remote attacker can trigger this with a single BIND request carrying a critical Session Tracking control, resulting in heap corruption and potential denial of service.

A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).

A null pointer dereference vulnerability (CVE-2025-2487) exists in 389 Directory Server (389-ds-base), an LDAPv3 compliant server used in Red Hat Enterprise Linux 9. This flaw can cause a denial of service condition. Red Hat has released updated packages addressing this issue with a security advisory rated as moderate severity. The vulnerability affects multiple architectures and variants of Red Hat Enterprise Linux 9. No CVSS score is provided in the advisory.

The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying `userPassword` using malformed input.

A moderate severity vulnerability (CVE-2024-5953) affects the 389-ds-base package in Red Hat Enterprise Linux 7 Extended Lifecycle Support. The issue involves a malformed userPassword hash that may cause a denial of service. Red Hat has released an update to address this vulnerability.

Two security vulnerabilities have been identified in the 389 Directory Server (389-ds-base), an LDAPv3 compliant server used in Red Hat Enterprise Linux 9. The first vulnerability (CVE-2024-3657) involves a potential denial of service triggered by a specially crafted Kerberos AS-REQ request. The second vulnerability (CVE-2024-2199) can cause the server to crash when processing a malformed userPassword during modification operations. Red Hat has released updates that fix these issues in versions 9.4.5, 9.6.5, and 9.8.5. No known exploits in the wild have been reported. The vulnerabilities are rated with a high security impact by Red Hat Product Security.

A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.