CVE-2025-14905

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

• 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow (CVE-2025-14905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

• 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow (CVE-2025-14905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

• 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow (CVE-2025-14905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the schema_attr_enum_callback function within the schema.c file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

• 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow (CVE-2025-14905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

• 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow (CVE-2025-14905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

• 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow (CVE-2025-14905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the schema_attr_enum_callback function within the schema.c file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).

• CVE-2025-14905: fix heap buffer overflow in schema.c

• CVE-2025-14905: fix heap buffer overflow in schema_attr_enum_callback allows Remote Code Execution and Denial of Service

These are all security issues fixed in the 389-ds-3.1.4+e2562f589-1.1 package on the GA media of openSUSE Tumbleweed.

This update for 389-ds fixes the following issue:

Update to 389-ds 3.0.6~git249.6688af9b2:

• CVE-2025-14905: heap buffer overflow due to improper size calculation in schema_attr_enum_callback can lead to DoS and RCE (bsc#1258727).

Changelog:

• Issue 7277 - UI - Fix Japanese translation for "Successfully updated group" in Cockpit UI (#7278)
• Issue 7275 - UI - Improve password policy field validation in Cockpit UI (#7276)
• Issue 7279 - UI - Fix typo in export certificate dialog (#7280)
• Issue 7273 - In a chaining environment binding as remote user causes an invalid error in the logs
• Issue 7271 - plugins that create threads need to update active thread count
• Issue 5853 - Update concread to 0.5.10
• Issue 7053 - Remove memberof_del_dn_from_groups from MemberOf plugin (#7064)
• Issue 7223 - Remove integerOrderingMatch requirement for parentid (#7264)
• Issue 7066/7052 - allow password history to be set to zero and remove history
• Issue 7223 - Use lexicographical order for ancestorid (#7256)
• Issue 7213 - (2nd) MDB_BAD_VALSIZE error while handling VLV (#7258)
• Issue 7184 - (2nd) argparse.HelpFormatter _format_actions_usage() is deprecated (#7257)
• Issue - CLI - dsctl db2index needs some hardening with MBD
• Issue 7248 - CLI - attribute uniqueness - fix usage for exclude subtree option
• Issue 7231 - Sync repl tests fail in FIPS mode due to non FIPS compliant crypto (#7232)
• Issue 7121 - (2nd) LeakSanitizer: various leaks during replication (#7212)
• Issue 6947 - Fix health_system_indexes_test.py
• Issue 7076 - Fix revert_cache() never called in modrdn (#7220)
• Issue 7076, 6992, 6784, 6214 - Fix CI test failures (#7077)
• Issue 7096 - (2nd) During replication online total init the function idl_id_is_in_idlist is not scaling with large database (#7205)
• Issue 3555 - UI - Fix audit issue with npm - @isaacs/brace-expansion (#7228)
• Issue 7223 - Add dsctl index-check command for offline index repair
• Issue 7223 - Detect and log index ordering mismatch during backend startup
• Issue 7223 - Add upgrade function to remove ancestorid index config entry
• Issue 7223 - Add upgrade function to remove nsIndexIDListScanLimit from parentid
• Issue 7223 - Revert index scan limits for system indexes
• Issue 6542 - RPM build errors on Fedora 42
• Issue 7224 - CI Test - Simplify test_reserve_descriptor_validation (#7225)
• Issue 7194 - Repl Log Analysis - Add CSN propagation details (#7195)
• Issue 7213 - MDB_BAD_VALSIZE error while handling VLV (#7214)
• Issue 7027 - (2nd) 389-ds-base OpenScanHub Leaks Detected (#7211)
• Issue 7184 - argparse.HelpFormatter _format_actions_usage() is deprecated
• Issue 7198 - Web console doesn't show sub-suffix when parent-suffix points to an entry (#7202)
• Issue 7189 - DSBLE0007 generates incorrect remediation commands for scan limits
• Bump lodash from 4.17.21 to 4.17.23 in /src/cockpit/389-console (#7203)
• Issue 7172 - (2nd) Index ordering mismatch after upgrade (#7180)
• Issue 7172 - Index ordering mismatch after upgrade (#7173)
• Issue - Revise paged result search locking
• Issue 7096 - During replication online total init the function idl_id_is_in_idlist is not scaling with large database (#7145)
• Revert "Issue 7160 - Add lib389 version sync check to configure (#7165)"
• Issue 7160 - Add lib389 version sync check to configure (#7165)
• Issue 7049 - RetroCL plugin generates invalid LDIF
• Issue 7150 - Compressed access log rotations skipped, accesslog-list out of sync (#7151)
• Restore definition for slapi_entry_attr_get_valuearray
• Issue 1793 - RFE - Dynamic lists - UI and CLI updates
• Issue 7119 - Fix DNA shared config replication test (#7143)
• Issue 7081 - Repl Log Analysis - Implement data sampling with performance and timezone fixes (#7086)
• Issue 1793 - RFE - Implement dynamic lists
• Issue 6753 - Port ticket tests
• Issue 6753 - Port and fix ticket 47823 tests
• Issue 6753 - Add 'add_exclude_subtree' and…

This update for 389-ds fixes the following issues:

• CVE-2025-14905: Fixed heap buffer overflow due to improper size calculation in schema_attr_enum_callback callback (bsc#1258727).

This update for 389-ds fixes the following issues:

• CVE-2025-14905: Fixed heap buffer overflow due to improper size calculation in schema_attr_enum_callback callback (bsc#1258727).

This update for 389-ds fixes the following issues:

Update to LTS branch 2.7 (jsc#PED-14342):

• CVE-2025-14905: Fixed heap buffer overflow due to improper size calculation in schema_attr_enum_callback callback (bsc#1258727).

Bug fixes:

• Resolve python build error that caused lib389 to be missing some libraries. (bsc#1258689)

This update for 389-ds fixes the following issues:

Update to version 2.0.20~git89.937b1f291.

Security issues fixed:

• CVE-2025-14905: heap buffer overflow due to improper size calculation in schema_attr_enum_callback callback (bsc#1258727).

Other updates and bugfixes:

• Issue 7224 - CI Test - Simplify test_reserve_descriptor_validation (#7225).
• Issue 7189 - DSBLE0007 generates incorrect remediation commands for scan limits.
• Issue 7172 - (2nd) Index ordering mismatch after upgrade (#7180).
• Issue 7172 - Index ordering mismatch after upgrade (#7173).
• Issue 7096 - During replication online total init the function idl_id_is_in_idlist is not scaling with large database (#7145).
• Issue 7091 - Duplicate local password policy entries listed (#7092).
• Issue 7124 - BDB cursor race condition with transaction isolation (#7125).
• Issue 7121 - LeakSanitizer: various leaks during replication (#7122).
• Issue 7115 - LeakSanitizer: leak in slapd_bind_local_user() (#7116).
• Issue 7109 - AddressSanitizer: SEGV ldap/servers/slapd/csnset.c:302 in csnset_dup (#7114).
• Issue 7056 - DSBLE0007 doesn't generate remediation steps for missing indexes.
• Issue 6846 - Attribute uniqueness is not enforced with modrdn (#7026).
• Issue 7055 - Online initialization of consumers fails with error -23 (#7075).
• Issue 7065 - A search filter containing a non normalized DN assertion does not return matching entries (#7068).
• Issue 7032 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue (#7036).
• Issue 6966 - On large DB, unlimited IDL scan limit reduce the SRCH performance (#6967).
• Issue 6848 - AddressSanitizer: leak in do_search.
• Issue 6928 - The parentId attribute is indexed with improper matching rule.
• Issue 6933 - When deferred memberof update is enabled after the server crashed it should not launch memberof fixup task by default (#6935).
• Issue 6929 - Compilation failure with rust-1.89 on Fedora ELN.
• Issue 6859 - str2filter is not fully applying matching rules.
• Issue 6857 - uiduniq: allow specifying match rules in the filter.
• Issue 6893 - Log user that is updated during password modify extended operation.
• Issue 6680 - instance read-only mode is broken (#6681).

This update for 389-ds fixes the following issue:

Update to 389-ds 3.0.6~git249.6688af9b2:

• CVE-2025-14905: heap buffer overflow due to improper size calculation in schema_attr_enum_callback can lead to DoS and RCE (bsc#1258727).

Changelog:

• Issue 7277 - UI - Fix Japanese translation for "Successfully updated group" in Cockpit UI (#7278)
• Issue 7275 - UI - Improve password policy field validation in Cockpit UI (#7276)
• Issue 7279 - UI - Fix typo in export certificate dialog (#7280)
• Issue 7273 - In a chaining environment binding as remote user causes an invalid error in the logs
• Issue 7271 - plugins that create threads need to update active thread count
• Issue 5853 - Update concread to 0.5.10
• Issue 7053 - Remove memberof_del_dn_from_groups from MemberOf plugin (#7064)
• Issue 7223 - Remove integerOrderingMatch requirement for parentid (#7264)
• Issue 7066/7052 - allow password history to be set to zero and remove history
• Issue 7223 - Use lexicographical order for ancestorid (#7256)
• Issue 7213 - (2nd) MDB_BAD_VALSIZE error while handling VLV (#7258)
• Issue 7184 - (2nd) argparse.HelpFormatter _format_actions_usage() is deprecated (#7257)
• Issue - CLI - dsctl db2index needs some hardening with MBD
• Issue 7248 - CLI - attribute uniqueness - fix usage for exclude subtree option
• Issue 7231 - Sync repl tests fail in FIPS mode due to non FIPS compliant crypto (#7232)
• Issue 7121 - (2nd) LeakSanitizer: various leaks during replication (#7212)
• Issue 6947 - Fix health_system_indexes_test.py
• Issue 7076 - Fix revert_cache() never called in modrdn (#7220)
• Issue 7076, 6992, 6784, 6214 - Fix CI test failures (#7077)
• Issue 7096 - (2nd) During replication online total init the function idl_id_is_in_idlist is not scaling with large database (#7205)
• Issue 3555 - UI - Fix audit issue with npm - @isaacs/brace-expansion (#7228)
• Issue 7223 - Add dsctl index-check command for offline index repair
• Issue 7223 - Detect and log index ordering mismatch during backend startup
• Issue 7223 - Add upgrade function to remove ancestorid index config entry
• Issue 7223 - Add upgrade function to remove nsIndexIDListScanLimit from parentid
• Issue 7223 - Revert index scan limits for system indexes
• Issue 6542 - RPM build errors on Fedora 42
• Issue 7224 - CI Test - Simplify test_reserve_descriptor_validation (#7225)
• Issue 7194 - Repl Log Analysis - Add CSN propagation details (#7195)
• Issue 7213 - MDB_BAD_VALSIZE error while handling VLV (#7214)
• Issue 7027 - (2nd) 389-ds-base OpenScanHub Leaks Detected (#7211)
• Issue 7184 - argparse.HelpFormatter _format_actions_usage() is deprecated
• Issue 7198 - Web console doesn't show sub-suffix when parent-suffix points to an entry (#7202)
• Issue 7189 - DSBLE0007 generates incorrect remediation commands for scan limits
• Bump lodash from 4.17.21 to 4.17.23 in /src/cockpit/389-console (#7203)
• Issue 7172 - (2nd) Index ordering mismatch after upgrade (#7180)
• Issue 7172 - Index ordering mismatch after upgrade (#7173)
• Issue - Revise paged result search locking
• Issue 7096 - During replication online total init the function idl_id_is_in_idlist is not scaling with large database (#7145)
• Revert "Issue 7160 - Add lib389 version sync check to configure (#7165)"
• Issue 7160 - Add lib389 version sync check to configure (#7165)
• Issue 7049 - RetroCL plugin generates invalid LDIF
• Issue 7150 - Compressed access log rotations skipped, accesslog-list out of sync (#7151)
• Restore definition for slapi_entry_attr_get_valuearray
• Issue 1793 - RFE - Dynamic lists - UI and CLI updates
• Issue 7119 - Fix DNA shared config replication test (#7143)
• Issue 7081 - Repl Log Analysis - Implement data sampling with performance and timezone fixes (#7086)
• Issue 1793 - RFE - Implement dynamic lists
• Issue 6753 - Port ticket tests
• Issue 6753 - Port and fix ticket 47823 tests
• Issue 6753 - Add 'add_exclude_subtree' and…