-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 04 Nov 2026 15:38:38 +0100 Source: apache-directory-api Architecture: source Version: 2.1.9-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> Changed-By: Pierre Gruet <pgt@debian.org> Closes: 1139171 1149877 Changes: apache-directory-api (2.1.9-1) unstable; urgency=medium . * Team upload * New upstream version 2.1.9: - Fixes CVE-2026-35563: It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allows a valid certificate issued for an entirely unrelated host to be improperly accepted. This oversight leaves the connection highly vulnerable to server impersonation and complete connection compromise. The root cause of this vulnerability lies in the incomplete TLS server identity verification within the LDAP client implementation. The attacker requires MITM capability on the network to exploit this vulnerability. This attacker must be able to present a certificate trusted by the client's configured trust store. The hostname verification has been enforced in the new version of the LDAP API. (Closes: #1139171) - Fixes CVE-2026-102731: Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer (or a MITM) can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs (OutOfMemoryError bypasses the DecoderException handlers) or pins the large allocation per connection while the attacker stalls. A handful of connections exhausts any heap. The same bytes from an unauthenticated pre-bind client hit any embedding server that did not set MAX_PDU_SIZE_ATTR. - Fixes CVE-2026-103552: Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. - Fixes CVE-2026-103877: Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some potential RCE. - Fixes CVE-2026-103878: Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. - Fixes CVE-2026-103880: Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced to avoid a server DOS. - Fixes CVE-2026-103885: Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. (Closes: #1149877) * Raising Standards version to 4.7.4: - Removing Priority: optional, which is now defaults * Removing unneeded versioned Build-Dependencies * Updating Build-Dependencies and the Maven rules * Adding a versioned Build-Dependency on mina2 * Switching to debhelper-compat 14, removing misc: substvar * Shipping NoVerificationTrustManager so that it can be used in apache-directory-server * Use secure URI in Homepage field. * Re-export upstream signing key without extra signatures. * Set upstream metadata fields: Bug-Database, Repository. . [ Bastien Roucariès ] * Raising d/watch version to 5 * Add salsa CI Checksums-Sha1: 32b4d51f65a3293f70a09ba435cf6cd6960fc4a2 2501 apache-directory-api_2.1.9-1.dsc 36095836a9841979115665a46616257521d9be1b 1754864 apache-directory-api_2.1.9.orig.tar.gz fb4645be9128f48b77c174c6211eebbe0d6f34f7 34028 apache-directory-api_2.1.9-1.debian.tar.xz 49f37b98b8b6375a6383d29b121ce77019d5bdb4 19287 apache-directory-api_2.1.9-1_amd64.buildinfo Checksums-Sha256: 4dea229f212ed829ee11c55ddabcf8a613ff73e05a834617f23724751ffdb54c 2501 apache-directory-api_2.1.9-1.dsc 6912b8ac32a402626af2fc574ba0213198bacd39e98d613a4115a0ab496d502f 1754864 apache-directory-api_2.1.9.orig.tar.gz 52a64c81b837d8e72f9d54ed49d2ea96fe2e6870d31276bdf401eccb6a909418 34028 apache-directory-api_2.1.9-1.debian.tar.xz 7500e79374eb00ff98b899f85048d609ba91a9d1a3f99ebdb1d1551b7529ebfa 19287 apache-directory-api_2.1.9-1_amd64.buildinfo Files: b4cb26935d0c8ff123b3cee268e0c9b6 2501 java optional apache-directory-api_2.1.9-1.dsc d5cad437eac85253591b9af28303fb10 1754864 java optional apache-directory-api_2.1.9.orig.tar.gz 0c9caeca331242102f301630bffe5972 34028 java optional apache-directory-api_2.1.9-1.debian.tar.xz 8874d558b426b9a19eab907d6cc0cd60 19287 java optional apache-directory-api_2.1.9-1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmrrSacACgkQYAMWptwn dHZ0rQ//Y13njt00x6R9jOBNGRYLlRBbK/LqOEimvvmfgGCOAw3syy3HvaO1j2bS ZEEnbsHcE9/wOIc3NGuUz0Qg96nu1Zh1hOckzp2ZKrh66NRyXQ3GYluwIQz7h6ct DsTFzqFGh8lgSgDacIIDHzqhDBiq2SnAykMjW1MGRqeP8vcpx/sznpPfnXzyomTg S6IwNj3+XuSGYMFi8xBAHviJImoM2s1de8t7FypZIwluTOa0VItH7IGd1w7XnZ+u I6wV3oWQaeY85UzBXgj3JBzRJPRJvYoZoZWBVkkYcjluchmb27aLACVomYq2rpm6 NexGZdpX8hQExhNlDIZmCB7zrRfj5XcznVyN2Bt3inlmwE08nKqZqC0OX4EJWIUp 9XBF1chjqJKRzosBHrZFjOQBxGP5xuQmLk44ZTYCiQJiPd4s430OIPXmiKCU09Rn 7lI1VPu7URccnpYLpsckkTjqGAkvkmO6I0soPV078mccJQ05Fo3cfjhy7VRpRfAG AhvJW1Uiqrb58xcUfcqK4psDlBS3kV8pYQdhE4pd4UqjI8RzW0DyZ3Wg/jCcHYMg z+n7rknDpK6jQ44Nc0xQMH40tLHmWocTleywiRe5w8h31OVAD4CV6HgFtihcbTkY uS79R1aCnE+V9e7caiMENbQtUIrgT2LHWV64bsftVVdmhO9B/S4= =+82X -----END PGP SIGNATURE-----
