openSUSE-SU-2026:21691-1

This update for 389-ds fixes the following issues:

Update to version 3.0.6~git382.7a51ea5f5.

Security issues fixed:

• CVE-2026-11610: heap buffer overflow in the SASL I/O layer via a crafted oversized LDAP UNBIND packet (bsc#1270695).
• CVE-2026-11611: unbounded memory growth allowed by the Content Synchronization persistent search plugin when an authenticated client stops reading sync responses (bsc#1267975).
• CVE-2026-11774: integer overflow in the SASL I/O layer leading to heap buffer overflow via crafted SASL packet length prefixes (bsc#1268298).
• CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure in LDAP responses to authenticated users (bsc#1268065).
• CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing semicolons during database import (bsc#1268064).
• CVE-2026-11787: heap buffer overread due to missing checks in string filter parsing (bsc#1268062).
• CVE-2026-11788: server crash due to missing allocation failure checks in the dereference control plugin (bsc#1268057).
• CVE-2026-11789: integer underflow in the SMD5 password storage plugin leading to a buffer overflow via a crafted password hash (bsc#1268058).
• CVE-2026-11790: excessive CPU consumption during authentication due to improper upper bounds enforcement in the PBKDF2-SHA256 password storage plugin (bsc#1268060).
• CVE-2026-11791: use-after-free in the schema reload mechanism can be triggered while concurrent LDAP query traffic is active (bsc#1268047).
• CVE-2026-11792: heap buffer overflow when audit logging is enabled and short cleartext passwords are logged (bsc#1268046).
• CVE-2026-11793: stack buffer overflow leading to crash via crafted credentials with an oversized algorithm ID (bsc#1268041).
• CVE-2026-11884: heap buffer overflow leading to crash when serializing objectclass definitions (bsc#1268115).
• CVE-2026-12528: heap buffer overflow during ACI parsing via malformed ACI strings (bsc#1268491).

Other updates and bugfixes:

• Version 3.0.6~git382.7a51ea5f5:

  • Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713)
  • Issue 7688 - BUG - partial address leak in sso token (#7689)
  • Issue 7705 - With memberOfEntryScope set, deferred memberOf skips MODIFY operations (#7706)
  • Issue 7698 - Fix silent entry loss in LMDB bulk import waiter handling (#7699)
  • Issue 7666 - Replication performance degradation during total init on high-latency storage (#7667)
  • Issue 7201 - Syscall overhead in LMDB import writer thread (#7204)
  • Issue 7645 - Add runtime LeakSanitizer leak check (#7646)
  • Issue 7714 - UI - sass import rules are deprecated
  • Issue 7658 - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND
  • Issue 7710 - MemberOf deferred update - Use condvar instead of sleep loop
  • Issue 7637 - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload
  • Issue 7578 - schema - attribute refcount is not maintained properly
  • Issue 7605 - Harden CI test ports against ephemeral allocation (#7692)
  • Issue 7528 - Retry the CI image pull instead of failing the job (#7691)
  • Backport Issue 7519 -- ignore obsolete entrydn when entryrdn is in use (#7657)
  • Issue 7460 - MOD_REPLACE on groups/link attributes modifies overlap targets (#7461)
  • Issue 7505 - RFE - CLI - add feature to determine which password policy applies to a user
  • Issue 7670 - BDB range searches intermittently fail with err=1 under write load (#7671)
  • Issue 7108 - Fix shutdown crash in entry cache destruction (#7163)
  • Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7662)
  • Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value (#7608)
  • Issue 7200 - repl-agmt create doesn't set some parameters (#7663)
  • Issue 7573 - Post-import cache autotuning does not recompute entry cache size (#7574)

• Version 3.0.6~git359.953dc780a:

  • Issue 7470 - dsctl localhost tls import-server-key-cert fails with 'expected str, bytes or os.PathLike object, not NoneType' (#7477)

• Version 3.0.6~git356.e6c148b60:

  • Issue 7611 - PBKDF2 password verification should reject invalid iteration count (#7613)
  • Issue 7558 - Total init sends the suffix entry twice (#7640)
  • Issue 7635 - Integer Underflow in {SMD5} Password Comparison (#7636)
  • Issue 7406 - Fix ldap-agent SNMP stats file loading (#7630)
  • Issue 7621 - Stack Buffer Overflow in Password checkPrefix
  • Issue 7623 - Heap Buffer Overflow in 389-ds-base Audit Log Password Masking
  • Issue 7602 - CI - lib389 user compare fails due to parentid mismatch (#7603)
  • Issue 7537 - CI - Fix replication log monitoring parser/timing failures (#7592)
  • Issue 7593 - Fix testimony docstring for SASL overflow test (#7606)
  • Issue 7530 - CI - Stabilize DNA plugin replication tests timing out in CI (#7572)
  • Issue 7593 - Reject invalid SASL packet length values in sasl_io_start_packet (#7594)
  • Issue 3555 - UI - Fix audit issue with npm - ws, js-yaml, babel/core (#7599)
  • Bump fast-uri from 3.1.0 to 3.1.2 in /src/cockpit/389-console (#7487)
  • Update dependency uuid to v14 [SECURITY] (#7456)
  • Update cockpit-389-ds-npm (major) (#7448)
  • Issue 7263 - UI - Use cockpit.file API for temporary file writes (#7590)
  • Issue 7541 - Add invalid ACL text header regression test (#7591)
  • Issue 7554 - UI - Revise local password policy layout
  • Issue 7521 - UI - make changes for cockpit API updates