🛡️ openSUSE-SU-2026:20415-1 — 389-ds (CVE-2025-14905)
Description
Security update for 389-ds
This update for 389-ds fixes the following issue:
Update to 389-ds 3.0.6~git249.6688af9b2:
- CVE-2025-14905: heap buffer overflow due to improper size calculation in
schema_attr_enum_callbackcan lead to DoS
and RCE (bsc#1258727).
Changelog:
- Issue 7277 - UI - Fix Japanese translation for "Successfully updated group" in Cockpit UI (#7278)
- Issue 7275 - UI - Improve password policy field validation in Cockpit UI (#7276)
- Issue 7279 - UI - Fix typo in export certificate dialog (#7280)
- Issue 7273 - In a chaining environment binding as remote user causes an invalid error in the logs
- Issue 7271 - plugins that create threads need to update active thread count
- Issue 5853 - Update concread to 0.5.10
- Issue 7053 - Remove memberof_del_dn_from_groups from MemberOf plugin (#7064)
- Issue 7223 - Remove integerOrderingMatch requirement for parentid (#7264)
- Issue 7066/7052 - allow password history to be set to zero and remove history
- Issue 7223 - Use lexicographical order for ancestorid (#7256)
- Issue 7213 - (2nd) MDB_BAD_VALSIZE error while handling VLV (#7258)
- Issue 7184 - (2nd) argparse.HelpFormatter _format_actions_usage() is deprecated (#7257)
- Issue - CLI - dsctl db2index needs some hardening with MBD
- Issue 7248 - CLI - attribute uniqueness - fix usage for exclude subtree option
- Issue 7231 - Sync repl tests fail in FIPS mode due to non FIPS compliant crypto (#7232)
- Issue 7121 - (2nd) LeakSanitizer: various leaks during replication (#7212)
- Issue 6947 - Fix health_system_indexes_test.py
- Issue 7076 - Fix revert_cache() never called in modrdn (#7220)
- Issue 7076, 6992, 6784, 6214 - Fix CI test failures (#7077)
- Issue 7096 - (2nd) During replication online total init the function idl_id_is_in_idlist is not scaling with large
database (#7205)
- Issue 3555 - UI - Fix audit issue with npm - @isaacs/brace-expansion (#7228)
- Issue 7223 - Add dsctl index-check command for offline index repair
- Issue 7223 - Detect and log index ordering mismatch during backend startup
- Issue 7223 - Add upgrade function to remove ancestorid index config entry
- Issue 7223 - Add upgrade function to remove nsIndexIDListScanLimit from parentid
- Issue 7223 - Revert index scan limits for system indexes
- Issue 6542 - RPM build errors on Fedora 42
- Issue 7224 - CI Test - Simplify test_reserve_descriptor_validation (#7225)
- Issue 7194 - Repl Log Analysis - Add CSN propagation details (#7195)
- Issue 7213 - MDB_BAD_VALSIZE error while handling VLV (#7214)
- Issue 7027 - (2nd) 389-ds-base OpenScanHub Leaks Detected (#7211)
- Issue 7184 - argparse.HelpFormatter _format_actions_usage() is deprecated
- Issue 7198 - Web console doesn't show sub-suffix when parent-suffix points to an entry (#7202)
- Issue 7189 - DSBLE0007 generates incorrect remediation commands for scan limits
- Bump lodash from 4.17.21 to 4.17.23 in /src/cockpit/389-console (#7203)
- Issue 7172 - (2nd) Index ordering mismatch after upgrade (#7180)
- Issue 7172 - Index ordering mismatch after upgrade (#7173)
- Issue - Revise paged result search locking
- Issue 7096 - During replication online total init the function idl_id_is_in_idlist is not scaling with large
database (#7145)
- Revert "Issue 7160 - Add lib389 version sync check to configure (#7165)"
- Issue 7160 - Add lib389 version sync check to configure (#7165)
- Issue 7049 - RetroCL plugin generates invalid LDIF
- Issue 7150 - Compressed access log rotations skipped, accesslog-list out of sync (#7151)
- Restore definition for slapi_entry_attr_get_valuearray
- Issue 1793 - RFE - Dynamic lists - UI and CLI updates
- Issue 7119 - Fix DNA shared config replication test (#7143)
- Issue 7081 - Repl Log Analysis - Implement data sampling with performance and timezone fixes (#7086)
- Issue 1793 - RFE - Implement dynamic lists
- Issue 6753 - Port ticket tests
- Issue 6753 - Port and fix ticket 47823 tests
- Issue 6753 - Add 'add_exclude_subtree' and 'remove_exclude_subtree' methods to Attribute uniqueness plugin
- Issue 6753 - Port ticket test 48026
- Issue 7128 - memory corruption in alias entry plugin (#7131)
- Issue 7091 - Duplicate local password policy entries listed (#7092)
- Issue 7124 - BDB cursor race condition with transaction isolation (#7125)
- Issue 7132 - Keep alive entry updated too soon after an offline import (#7133)
- Issue 7121 - LeakSanitizer: various leaks during replication (#7122)
- Issue 7115 - LeakSanitizer: leak in
slapd_bind_local_user()(#7116) - Issue 7109 - AddressSanitizer: SEGV ldap/servers/slapd/csnset.c:302 in csnset_dup (#7114)
- Issue 7056 - DSBLE0007 doesn't generate remediation steps for missing indexes
- Issue 7119 - Harden DNA plugin locking for shared server list operations (#7120)
- Issue 7084 - UI - schema - sorting attributes breaks expanded row
- Issue 7007 - Improve paged result search locking
- Issue 3555 - UI - Fix audit issue with npm - glob (#7107)
- Is
Affected software
openSUSE-SU-2026:20415-1 is recorded against 1 package.
- 389-ds (fixed in 3.0.6~git249.6688af9b2-160000.1.1)
Timeline and source
Published on 24 March 2026 and last revised on 29 March 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.
References
Details
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| 389-ds | — | 3.0.6~git249.6688af9b2-160000.1.1 |
References
Similar Threats
- Unknown openSUSE-SU-2026:21011-1
- Unknown openSUSE-SU-2026:10870-1
- Unknown openSUSE-SU-2026:10500-1
- Unknown openSUSE-SU-2025:15056-1
- Unknown openSUSE-SU-2025:14934-1
Free Vulnerability Check
Is your site affected by openSUSE-SU-2026:20415-1?
BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against openSUSE-SU-2026:20415-1 and other known CVE records.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.