Ian Murphy

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (affected versions not specified) **Description** An unauthenticated remote attacker can perform an LDAP filter injection within the CleanAllRUV replication status-check extended operation. The handler executes the search against `cn=config` using elevated replication plugin privileges and returns a boolean match result. This allows an attacker to extract sensitive server configuration metadata, such as replication bind DNs and password storage scheme information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sssd (affected versions not specified) rhcos (affected versions not specified) **Description** A flaw exists in the SSSD LDAP sudo provider due to insecure default configuration and improper scoping of LDAP searches. When the `ldap sudo search base` option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any LDAP subtree can inject a crafted sudoRole object, allowing them to grant themselves root-level sudo privileges on all SSSD-enrolled hosts, potentially leading to full system compromise and lateral movement. **Recommendations** Upgrade to a vendor-fixed version. As a temporary mitigation, explicitly set the `ldap sudo search base` option.

**Name of the Vulnerable Software and Affected Versions** SSSD (affected versions not specified) **Description** A path traversal flaw exists in the AD GPO provider of SSSD. The `ad gpo extract smb components()` function fails to sanitize `..` sequences within the `gPCFileSysPath` LDAP attribute. This allows an attacker with AD GPO management access to write files outside the GPO cache directory with root privileges. In default RHEL configurations where SELinux is enforcing, this flaw can be exploited to inject Kerberos configuration, potentially resulting in an authentication bypass. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (389-ds-base) versions 1.3.2 through 11.12.4 Update1 389 Directory Server (389-ds-base) versions 12.0 through 12.12 389 Directory Server (389-ds-base) versions 2025.1 through 2026.2 **Description** A heap buffer overflow exists in the SASL I/O layer. After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet. This packet is copied into a 512-byte heap receive buffer without a bounds check in the `sasl io recv()` function within `sasl io.c`, allowing up to approximately 2 megabytes of attacker-controlled data to overflow the buffer. This can lead to memory corruption or a denial of service resulting in a server crash. In FreeIPA and Red Hat Identity Management deployments, the issue can be triggered over the network by any domain user with a valid Kerberos ticket, any enrolled host, or any service account after authenticating via GSSAPI. **Recommendations** Update 389 Directory Server (389-ds-base) versions 1.3.2 through 11.12.4 Update1 to the latest patched version. Update 389 Directory Server (389-ds-base) versions 12.0 through 12.12 to the latest patched version. Update 389 Directory Server (389-ds-base) versions 2025.1 through 2026.2 to the latest patched version.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (389-ds-base) (affected versions not specified) **Description** An integer overflow exists in the SASL I/O layer within the `sasl io start packet()` function. When a crafted SASL packet length prefix of 0xFFFFFFFC is processed, adding `sizeof(uint32 t)` causes an unsigned wraparound to zero. This action bypasses the `nsslapd-maxsasliosize` limit, resulting in a heap buffer overflow of approximately 2 megabytes of attacker-controlled data. Following a successful SASL bind with integrity protection (SSF > 0), a remote attacker can trigger a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, this can be executed over the network by any domain user with a valid Kerberos ticket, enrolled host, or service account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (affected versions not specified) **Description** A flaw exists during schema reload where the `attr syntax swap ht()` function unconditionally frees attribute syntax information nodes. This action bypasses the refcount-based deferred deletion mechanism used in the attribute syntax subsystem. If a schema reload is triggered while concurrent LDAP query traffic is active, worker threads may access freed memory, leading to a use-after-free or double-free condition, which results in a denial of service via a server crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (affected versions not specified) **Description** A heap buffer overflow occurs during the serialization of objectclass definitions. The length of the `oc superior` (SUP) field is omitted from buffer size calculations within the `read schema dse()` and `schema oc to string()` functions, yet the field is still written using `strcat()`. An attacker with Directory Manager privileges or a compromised replication supplier can cause a server crash by creating objectclasses with long SUP values. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (affected versions not specified) **Description** A heap buffer overflow occurs when audit logging is enabled. The `create masked entry string()` function in `auditlog.c` copies a fixed-length password mask into a heap buffer without verifying the available space. If a short cleartext password is logged, which requires non-default CLEAR password storage or a compromised replication peer, the copy operation overflows the buffer, leading to heap memory corruption and corrupted audit log output. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (affected versions not specified) **Description** A stack buffer overflow exists in the `checkPrefix()` function within `pw.c`. The issue occurs when parsing reversible-encrypted attribute values, as an attacker-controlled algorithm ID is copied into a 256-byte stack buffer without proper bounds checking. An attacker with Directory Manager privileges can cause a denial of service by crashing the LDAP server through the storage of a crafted credential containing an oversized algorithm ID. The use of FORTIFY SOURCE limits the impact to a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (affected versions not specified) **Description** A type confusion in the SSO token extended operation handler allows authenticated users to obtain partial stack address information through LDAP responses. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (affected versions not specified) **Description** A flaw exists in the LDIF parser where it reads past the end of a heap buffer when processing attribute types that contain trailing semicolons during a database import. This results in an out-of-bounds read, which is a condition where the software reads data from a memory location outside the intended boundary of the buffer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (affected versions not specified) **Description** A flaw exists in the `ldap utf8prev()` function where bytes are read before the start of a buffer without proper bounds checking. This leads to a heap buffer over-read during string filter parsing, which can influence internal filter processing behavior. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (affected versions not specified) **Description** The dereference control plugin fails to check for allocation failure before utilizing a Basic Encoding Rules (BER) structure. This allows an unauthenticated remote attacker to cause a crash of the LDAP server during periods of system memory pressure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (affected versions not specified) **Description** A flaw in the SMD5 password storage plugin allows an unsigned integer underflow when calculating the salt length from a crafted password hash shorter than 16 bytes. This leads to a buffer over-read, which causes the LDAP server to crash during the authentication process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (affected versions not specified) **Description** A flaw exists in the PBKDF2-SHA256 password storage plugin where the system fails to enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker with the ability to modify a user's password hash can trigger excessive CPU consumption during the authentication process, leading to a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (affected versions not specified) **Description** A flaw in the Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses, which can lead to a denial of service. Additionally, race conditions within the plugin thread lifecycle may cause system crashes during connection teardown or shutdown. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.