Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package 389-ds for openSUSE:Factory checked in at 2026-10-28 17:44:15 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/389-ds (Old) and /work/SRC/openSUSE:Factory/.389-ds.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "389-ds" Wed Oct 28 17:44:15 2026 rev:95 rq:1393004 version:3.3.1+28b6d8afc Changes: -------- --- /work/SRC/openSUSE:Factory/389-ds/389-ds.changes 2026-09-10 11:47:12.628052988 +0200 +++ /work/SRC/openSUSE:Factory/.389-ds.new.2252680/389-ds.changes 2026-10-28 17:44:33.681086018 +0100 @@ -1,0 +2,38 @@ +Tue Oct 27 06:40:25 UTC 2026 - [email protected] + +- bsc#1284028 - CVE-2026-86344 - incomplete LDAP messages sent in rapid succession can cause worker thread exhaustion +- bsc#1284034 - CVE-2026-86345 - smuggled plaintext commands sent alongside StartTLS requests can cause response forgery and authentication bypasses +- Update to version 3.3.1+28b6d8afc: + * Issue 7919 - Coordinate PDU writer handoff and buffered reads + * Issue 7919 - CVE-2026-86344 - Fix worker pool exhaustion via partial LDAP messages (DoS) + * Issue 8001 - RFE - log total number of entries in each backend + * Issue 8017 - Server can hang at shutdown after an aborted import (#8026) + * Issue 7879 - Outbound SASL bind waits forever while holding krb5_lock (#7881) (#7926) + * Issue 7827 - Preserve dsEntryDN case from DN cache (#7828) + * Issue 7877 - UI - add view raw entry action (#7878) + * Issue 7915 - UI - Reindexing single attribute does not show progress in modal (#7916) (#7930) + * Issue 7953 - dsrate - should use server's ldif directory location (#7954) + * Issue 7921 - Fix StartTLS plaintext buffer handling (#7922) + * Issue 7912 - dsidm role create-filtered ignores --nsrolefilter and forces an interactive prompt (#7913) + * Issue 7908 - dsctl cockpit open-firewall --zone passes a malformed argument (#7909) + * Issue 7905 - man: fix dropped line in 99user.ldif(5) example (#7906) + * Issue 7742 - memory leak in schema replication (#7894) + * Issue 7848 - Reject incomplete MD5 and GOST-YESCRYPT hashes (#7849) + * Issue 7744 - memory leak in search referral handling (#7884) + * Issue 7702 - memory leak in send_specific_attrs() (#7883) + * Issue 7745 - memory leak in replication replica init (#7892) + * Issue 7887 - Prevent password reuse when changing multiple passwords (#7888) + * Issue 4598 - Copy attribute syntax hashtables to each worker thread (#5693) + * Issue 7835 - rdn can be NULL when passed to bdb_has_spaces() in bdb_upgradedn_producer() + * Issue 7837 - importing ldif with entry with long attribute name and subtype causes stack-buffer-overflow (#7838) + * Issue 6270 - heap-use-after-free with pwp dictionary path (#7791) + * Issue 7863 - remove redundant strcmp's in schema superset checking + * Issue 7506 - CLI/UI - Add option to list accounts by status (#7818) + * Issue 7627 - When it exists configured matching rule for an (#7628) + * Issue 7832 - remove instance monitor directory when server is removed (#7839) + * Issue 7772 - double-free when processing an invalid Session Tracking control (#7773) + * iadvisories/GHSA-rgxx-hcc4-x3h4 / heap-buffer-overflow in rdn_av_swap (#7826) + * Issue 7823 - CI: stabilize test_controltype_expired_grace_limit (#7824) + * Issue 7815 - Support nsslapd-attribute-name-exceptions when adding entries + +------------------------------------------------------------------- @@ -4,4 +42,4 @@ -- CVE-2026-18922 - During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind -- CVE-2026-19843 - The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string -- CVE-2026-76560 - A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN -- CVE-2026-18355 - A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). +- bsc#1279864 - CVE-2026-18355 - A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). +- bsc#1279865 - CVE-2026-18922 - During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind +- bsc#1279866 - CVE-2026-19843 - The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string +- bsc#1279867 - CVE-2026-76560 - A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN Old: ---- 389-ds-base-3.3.1+8c2711bd6.tar.zst New: ---- 389-ds-base-3.3.1+28b6d8afc.tar.zst ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ 389-ds.spec ++++++ --- /var/tmp/diff_new_pack.0zPLuV/_old 2026-10-28 17:44:36.946222778 +0100 +++ /var/tmp/diff_new_pack.0zPLuV/_new 2026-10-28 17:44:36.948222861 +0100 @@ -31,7 +31,7 @@ %define svrcorelib libsvrcore0 Name: 389-ds -Version: 3.3.1+8c2711bd6 +Version: 3.3.1+28b6d8afc Release: 0 Summary: 389 Directory Server License: GPL-3.0-or-later AND MPL-2.0 ++++++ 389-ds-base-3.3.1+8c2711bd6.tar.zst -> 389-ds-base-3.3.1+28b6d8afc.tar.zst ++++++ /work/SRC/openSUSE:Factory/389-ds/389-ds-base-3.3.1+8c2711bd6.tar.zst /work/SRC/openSUSE:Factory/.389-ds.new.2252680/389-ds-base-3.3.1+28b6d8afc.tar.zst differ: char 7, line 1 ++++++ 389-ds-base.obsinfo ++++++ --- /var/tmp/diff_new_pack.0zPLuV/_old 2026-10-28 17:44:37.111229689 +0100 +++ /var/tmp/diff_new_pack.0zPLuV/_new 2026-10-28 17:44:37.119230024 +0100 @@ -1,5 +1,5 @@ name: 389-ds-base -version: 3.3.1+8c2711bd6 -mtime: 1788898182 -commit: 8c2711bd67f9725db452e9e691e6667e63ff4090 +version: 3.3.1+28b6d8afc +mtime: 1793041574 +commit: 28b6d8afc4b10c5d1200eb942b7be7b7940f4d7b ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.0zPLuV/_old 2026-10-28 17:44:37.348239616 +0100 +++ /var/tmp/diff_new_pack.0zPLuV/_new 2026-10-28 17:44:37.361240160 +0100 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/389ds/389-ds-base.git</param> - <param name="changesrevision">8c2711bd67f9725db452e9e691e6667e63ff4090</param></service></servicedata> + <param name="changesrevision">28b6d8afc4b10c5d1200eb942b7be7b7940f4d7b</param></service></servicedata> (No newline at EOF) ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/389-ds/vendor.tar.zst /work/SRC/openSUSE:Factory/.389-ds.new.2252680/vendor.tar.zst differ: char 7, line 1
