389-ds-base - Debian Package Tracker

general

source: 389-ds-base (main)
version: 3.1.2+dfsg1-1
maintainer: Debian FreeIPA Team (archive) (DMD)
uploaders: Timo Aaltonen [DMD]
arch: all any
std-ver: 4.6.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 1.4.4.11-2
old-sec: 1.4.4.11-2+deb11u1
stable: 2.3.1+dfsg1-1+deb12u1
testing: 3.1.2+dfsg1-1
unstable: 3.1.2+dfsg1-1

versioned links

1.4.4.11-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.4.11-2+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.3.1+dfsg1-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.2+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

389-ds (1 bugs: 0, 1, 0, 0)
389-ds-base (4 bugs: 0, 4, 0, 0)
389-ds-base-dev
389-ds-base-libs
cockpit-389-ds (1 bugs: 0, 1, 0, 0)
python3-lib389

action needed

A new upstream version is available: 3.1.3 high

A new upstream version 3.1.3 is available, you should consider packaging it.

Created: 2025-06-29 Last update: 2025-07-30 04:05

4 security issues in bookworm high

There are 4 open security issues in bookworm.

1 important issue:

CVE-2025-2487: A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a failed operation, it could lead to a Denial of Service (DoS) or system crash.

3 issues left for the package maintainer to handle:

CVE-2023-1055: (needs triaging) A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.
CVE-2024-1062: (needs triaging) A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.
CVE-2024-6237: (needs triaging) A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service.

You can find information about how to handle these issues in the security team's documentation.

Created: 2023-06-10 Last update: 2025-04-24 14:00

6 security issues in buster high

There are 6 open security issues in buster.

3 important issues:

CVE-2024-2199: A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input.
CVE-2024-3657: A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service
CVE-2024-5953: A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.

2 issues postponed or untriaged:

CVE-2023-1055: (needs triaging) A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.
CVE-2024-1062: (needs triaging) A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.

1 ignored issue:

CVE-2022-1949: An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.

Created: 2024-05-29 Last update: 2024-06-19 07:13

Depends on packages which need a new maintainer normal

The packages that 389-ds-base depends on which need a new maintainer are:

db5.3 (#1055356)
- Depends: libdb5.3t64
db-defaults (#1055344)
- Build-Depends: libdb-dev

Created: 2023-11-04 Last update: 2025-07-30 08:00

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 3.1.2+dfsg1-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit fcfaad5a0a82eea816b547822b55c369bc9cf649
Author: Timo Aaltonen <tjaalton@debian.org>
Date:   Wed Jun 25 12:34:39 2025 +0300

    control: Add libcrypt-dev to build-depends. (Closes: #1106912)

Created: 2025-06-25 Last update: 2025-07-26 15:01

lintian reports 55 warnings normal

Lintian reports 55 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-04-11 Last update: 2025-04-11 08:00

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2025-04-11 Last update: 2025-04-11 22:32

debian/patches: 5 patches to forward upstream low

Among the 5 debian patches available in version 3.1.2+dfsg1-1 of the package, we noticed the following issues:

5 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-04-10 20:32

Build log checks report 2 warnings low

Build log checks report 2 warnings

Created: 2022-03-14 Last update: 2023-01-21 07:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 4.6.0).

Created: 2022-05-11 Last update: 2025-04-10 16:24

news

[rss feed]

[2025-04-12] 389-ds-base 3.1.2+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2025-04-10] Accepted 389-ds-base 3.1.2+dfsg1-1 (source) into unstable (Timo Aaltonen)
[2025-01-25] Accepted 389-ds-base 2.3.1+dfsg1-1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Andrew Shadura)
[2025-01-19] Accepted 389-ds-base 1.4.4.11-2+deb11u1 (source) into oldstable-security (Andrej Shadura) (signed by: Andrew Shadura)
[2025-01-08] Accepted 389-ds-base 3.1.1+dfsg1-3 (source) into unstable (Timo Aaltonen)
[2024-12-10] 389-ds-base REMOVED from testing (Debian testing watch)
[2024-10-04] 389-ds-base 3.1.1+dfsg1-2 MIGRATED to testing (Debian testing watch)
[2024-10-02] Accepted 389-ds-base 3.1.1+dfsg1-2 (source) into unstable (Timo Aaltonen)
[2024-08-09] 389-ds-base 3.1.1+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2024-08-07] Accepted 389-ds-base 3.1.1+dfsg1-1 (source) into unstable (Timo Aaltonen)
[2024-07-17] 389-ds-base REMOVED from testing (Debian testing watch)
[2024-06-08] 389-ds-base 2.4.5+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2024-06-03] 389-ds-base REMOVED from testing (Debian testing watch)
[2024-05-03] 389-ds-base 2.4.5+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2024-04-25] Accepted 389-ds-base 3.0.2+dfsg1-1 (source) into experimental (Timo Aaltonen)
[2024-04-15] Accepted 389-ds-base 2.4.5+dfsg1-1 (source) into unstable (Timo Aaltonen)
[2024-02-13] 389-ds-base 2.4.4+dfsg1-3 MIGRATED to testing (Debian testing watch)
[2024-02-13] 389-ds-base 2.4.4+dfsg1-3 MIGRATED to testing (Debian testing watch)
[2024-02-10] Accepted 389-ds-base 2.4.4+dfsg1-3 (source) into unstable (Timo Aaltonen)
[2024-01-08] Accepted 389-ds-base 2.4.4+dfsg1-1 (source) into unstable (Timo Aaltonen)
[2023-12-30] 389-ds-base 2.3.4+dfsg1-1.1 MIGRATED to testing (Debian testing watch)
[2023-12-28] Accepted 389-ds-base 2.3.4+dfsg1-1.1 (source) into unstable (Bo YU) (signed by: bage@debian.org)
[2023-11-10] 389-ds-base REMOVED from testing (Debian testing watch)
[2023-07-01] 389-ds-base 2.3.4+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2023-07-01] 389-ds-base 2.3.4+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2023-06-19] Accepted 389-ds-base 2.3.4+dfsg1-1 (source) into unstable (Timo Aaltonen)
[2023-04-24] Accepted 389-ds-base 1.4.0.21-1+deb10u1 (source) into oldstable (Anton Gladky)
[2023-01-26] 389-ds-base 2.3.1+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2023-01-24] Accepted 389-ds-base 2.3.1+dfsg1-1 (source) into unstable (Timo Aaltonen)
[2023-01-20] Accepted 389-ds-base 2.3.1-1 (source) into unstable (Timo Aaltonen)

bugs [bug history graph]

all: 11
RC: 0
I&N: 9
M&W: 2
F&P: 0
patch: 0

links

homepage
lintian (0, 55)
buildd: logs, checks, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
l10n (-, 100)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.1.2+dfsg1-1
7 bugs