rpm package
almalinux/389-ds-base
pkg:rpm/almalinux/389-ds-base
Vulnerabilities (22)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-18922 | Cri | 9.8 | < 2.8.0-10.el9_8 | 2.8.0-10.el9_8 | Sep 7, 2026 | A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL me | |
| CVE-2026-18453 | Hig | 7.5 | < 2.8.0-10.el9_8 | 2.8.0-10.el9_8 | Sep 7, 2026 | A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resultin | |
| CVE-2026-18355 | Hig | 7.5 | < 2.8.0-10.el9_8 | 2.8.0-10.el9_8 | Sep 7, 2026 | A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an encrypted_buffer_count | |
| CVE-2026-76560 | Hig | 7.5 | < 2.8.0-10.el9_8 | 2.8.0-10.el9_8 | Sep 7, 2026 | A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching au | |
| CVE-2026-78701 | Med | 6.5 | < 2.8.0-10.el9_8 | 2.8.0-10.el9_8 | Aug 25, 2026 | A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaust | |
| CVE-2026-15722 | Hig | 7.5 | < 2.8.0-9.el9_8 | 2.8.0-9.el9_8 | Jul 31, 2026 | A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated at | |
| CVE-2026-11770 | Hig | 7.5 | < 2.8.0-9.el9_8 | 2.8.0-9.el9_8 | Jul 31, 2026 | A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and | |
| CVE-2026-11610 | Hig | 8.8 | < 2.8.0-8.el9_8 | 2.8.0-8.el9_8 | Jul 7, 2026 | A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte | |
| CVE-2026-11774 | Hig | 7.6 | < 2.8.0-8.el9_8 | 2.8.0-8.el9_8 | Jun 11, 2026 | An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit an | |
| CVE-2026-11788 | Med | 5.9 | < 2.8.0-9.el9_8 | 2.8.0-9.el9_8 | Jun 9, 2026 | A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure. | |
| CVE-2026-9064 | Hig | 7.5 | < 2.8.0-7.el9_8 | 2.8.0-7.el9_8 | May 20, 2026 | A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousand | |
| CVE-2025-14905 | Hig | 7.2 | < 2.7.0-10.el9_7 | 2.7.0-10.el9_7 | Feb 23, 2026 | A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting f | |
| CVE-2025-2487 | Med | 4.9 | < 2.5.2-9.el9_5 | 2.5.2-9.el9_5 | Mar 18, 2025 | A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a fail | |
| CVE-2024-6237 | Med | 6.5 | < 2.4.5-9.el9_4 | 2.4.5-9.el9_4 | Jul 9, 2024 | A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service. | |
| CVE-2024-5953 | Med | 5.7 | < 2.4.5-9.el9_4 | 2.4.5-9.el9_4 | Jun 18, 2024 | A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password. | |
| CVE-2024-3657 | Hig | 7.5 | < 2.4.5-8.el9_4 | 2.4.5-8.el9_4 | May 28, 2024 | A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service | |
| CVE-2024-2199 | Med | 5.7 | < 2.4.5-8.el9_4 | 2.4.5-8.el9_4 | May 28, 2024 | A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input. | |
| CVE-2024-1062 | Med | 5.5 | < 1.4.3.39-3.module_el8.10.0+3829+ea459e35 | 1.4.3.39-3.module_el8.10.0+3829+ea459e35 | Feb 12, 2024 | A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr. | |
| CVE-2022-2850 | Med | 6.5 | < 1.4.3.28-8.module_el8.6.0+3338+ebccfef1 | 1.4.3.28-8.module_el8.6.0+3338+ebccfef1 | Oct 14, 2022 | A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against a | |
| CVE-2022-0996 | Med | 6.5 | < 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c | 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c | Mar 23, 2022 | A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. |
- affected < 2.8.0-10.el9_8fixed 2.8.0-10.el9_8
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL me
- affected < 2.8.0-10.el9_8fixed 2.8.0-10.el9_8
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resultin
- affected < 2.8.0-10.el9_8fixed 2.8.0-10.el9_8
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an encrypted_buffer_count
- affected < 2.8.0-10.el9_8fixed 2.8.0-10.el9_8
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching au
- affected < 2.8.0-10.el9_8fixed 2.8.0-10.el9_8
A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaust
- affected < 2.8.0-9.el9_8fixed 2.8.0-9.el9_8
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated at
- affected < 2.8.0-9.el9_8fixed 2.8.0-9.el9_8
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and
- affected < 2.8.0-8.el9_8fixed 2.8.0-8.el9_8
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte
- affected < 2.8.0-8.el9_8fixed 2.8.0-8.el9_8
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit an
- affected < 2.8.0-9.el9_8fixed 2.8.0-9.el9_8
A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.
- affected < 2.8.0-7.el9_8fixed 2.8.0-7.el9_8
A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousand
- affected < 2.7.0-10.el9_7fixed 2.7.0-10.el9_7
A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting f
- affected < 2.5.2-9.el9_5fixed 2.5.2-9.el9_5
A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a fail
- affected < 2.4.5-9.el9_4fixed 2.4.5-9.el9_4
A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service.
- affected < 2.4.5-9.el9_4fixed 2.4.5-9.el9_4
A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.
- affected < 2.4.5-8.el9_4fixed 2.4.5-8.el9_4
A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service
- affected < 2.4.5-8.el9_4fixed 2.4.5-8.el9_4
A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input.
- affected < 1.4.3.39-3.module_el8.10.0+3829+ea459e35fixed 1.4.3.39-3.module_el8.10.0+3829+ea459e35
A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.
- affected < 1.4.3.28-8.module_el8.6.0+3338+ebccfef1fixed 1.4.3.28-8.module_el8.6.0+3338+ebccfef1
A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against a
- affected < 1.4.3.28-7.module_el8.6.0+3071+d20b1d7cfixed 1.4.3.28-7.module_el8.6.0+3071+d20b1d7c
A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication.
Page 1 of 2