389-ds-base - Debian Package Tracker

general

source: 389-ds-base (main)
version: 3.1.2+vendor1-1
maintainer: Debian FreeIPA Team (archive) (DMD)
uploaders: Timo Aaltonen [DMD]
arch: all any
std-ver: 4.6.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.4.4.11-2
o-o-sec: 1.4.4.11-2+deb11u1
oldstable: 2.3.1+dfsg1-1+deb12u1
stable: 3.1.2+dfsg1-1
unstable: 3.1.2+vendor1-1

versioned links

1.4.4.11-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.4.11-2+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.3.1+dfsg1-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.2+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.2+vendor1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

389-ds (1 bugs: 0, 1, 0, 0)
389-ds-base (4 bugs: 0, 4, 0, 0)
389-ds-base-dev
389-ds-base-libs
cockpit-389-ds (2 bugs: 1, 1, 0, 0)
python3-lib389

action needed

A new upstream version is available: 3.2.0 high

A new upstream version 3.2.0 is available, you should consider packaging it.

Created: 2025-11-26 Last update: 2026-04-19 05:30

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2025-14905: A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).

Created: 2026-02-24 Last update: 2026-04-17 23:30

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2025-14905: A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).

Created: 2026-02-24 Last update: 2026-04-17 23:30

6 security issues in bullseye high

There are 6 open security issues in bullseye.

1 important issue:

CVE-2025-14905: A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).

4 issues postponed or untriaged:

CVE-2023-1055: (needs triaging) A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.
CVE-2024-1062: (needs triaging) A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.
CVE-2024-6237: (postponed; to be fixed through a stable update) A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service.
CVE-2025-2487: (postponed; to be fixed through a stable update) A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a failed operation, it could lead to a Denial of Service (DoS) or system crash.

1 ignored issue:

CVE-2022-1949: An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.

Created: 2026-02-24 Last update: 2026-04-17 23:30

5 security issues in bookworm high

There are 5 open security issues in bookworm.

1 important issue:

CVE-2025-14905: A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).

4 issues left for the package maintainer to handle:

CVE-2023-1055: (needs triaging) A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.
CVE-2024-1062: (needs triaging) A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.
CVE-2024-6237: (needs triaging) A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service.
CVE-2025-2487: (needs triaging) A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a failed operation, it could lead to a Denial of Service (DoS) or system crash.

You can find information about how to handle these issues in the security team's documentation.

Created: 2023-06-10 Last update: 2026-04-17 23:30

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

Created: 2025-06-25 Last update: 2026-04-17 21:01

6 security issues in buster high

There are 6 open security issues in buster.

3 important issues:

CVE-2024-2199: A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input.
CVE-2024-3657: A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service
CVE-2024-5953: A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.

2 issues postponed or untriaged:

CVE-2023-1055: (needs triaging) A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.
CVE-2024-1062: (needs triaging) A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.

1 ignored issue:

CVE-2022-1949: An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.

Created: 2024-05-29 Last update: 2024-06-19 07:13

Depends on packages which need a new maintainer normal

The packages that 389-ds-base depends on which need a new maintainer are:

db5.3 (#1055356)
- Depends: libdb5.3t64
db-defaults (#1055344)
- Build-Depends: libdb-dev

Created: 2023-11-04 Last update: 2026-04-19 08:30

lintian reports 53 warnings normal

Lintian reports 53 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-04-18 Last update: 2026-04-18 06:00

debian/patches: 5 patches to forward upstream low

Among the 5 debian patches available in version 3.1.2+vendor1-1 of the package, we noticed the following issues:

5 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-04-18 09:00

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2025-04-11 Last update: 2025-04-11 22:32

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.6.0).

Created: 2022-05-11 Last update: 2026-04-17 22:47

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status for 389-ds-base (- to 3.1.2+vendor1-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating 389-ds-base would introduce bugs in testing: #1083298, #1111889
- ∙ ∙ Autopkgtest for 389-ds-base/3.1.2+vendor1-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Test triggered, riscv64: Pass, s390x: Pass
- ∙ ∙ Too young, only 1 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/3/389-ds-base.html
- ∙ ∙ Reproduced on amd64
- ∙ ∙ Reproduced on arm64
- ∙ ∙ Reproduced on armhf
- ∙ ∙ Reproduced on i386
- ∙ ∙ Reproducibility check waiting for results on ppc64el
- Not considered

news

[rss feed]

[2026-04-17] Accepted 389-ds-base 3.1.2+vendor1-1 (source) into unstable (Timo Aaltonen)
[2025-10-08] 389-ds-base REMOVED from testing (Debian testing watch)
[2025-04-12] 389-ds-base 3.1.2+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2025-04-10] Accepted 389-ds-base 3.1.2+dfsg1-1 (source) into unstable (Timo Aaltonen)
[2025-01-25] Accepted 389-ds-base 2.3.1+dfsg1-1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Andrew Shadura)
[2025-01-19] Accepted 389-ds-base 1.4.4.11-2+deb11u1 (source) into oldstable-security (Andrej Shadura) (signed by: Andrew Shadura)
[2025-01-08] Accepted 389-ds-base 3.1.1+dfsg1-3 (source) into unstable (Timo Aaltonen)
[2024-12-10] 389-ds-base REMOVED from testing (Debian testing watch)
[2024-10-04] 389-ds-base 3.1.1+dfsg1-2 MIGRATED to testing (Debian testing watch)
[2024-10-02] Accepted 389-ds-base 3.1.1+dfsg1-2 (source) into unstable (Timo Aaltonen)
[2024-08-09] 389-ds-base 3.1.1+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2024-08-07] Accepted 389-ds-base 3.1.1+dfsg1-1 (source) into unstable (Timo Aaltonen)
[2024-07-17] 389-ds-base REMOVED from testing (Debian testing watch)
[2024-06-08] 389-ds-base 2.4.5+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2024-06-03] 389-ds-base REMOVED from testing (Debian testing watch)
[2024-05-03] 389-ds-base 2.4.5+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2024-04-25] Accepted 389-ds-base 3.0.2+dfsg1-1 (source) into experimental (Timo Aaltonen)
[2024-04-15] Accepted 389-ds-base 2.4.5+dfsg1-1 (source) into unstable (Timo Aaltonen)
[2024-02-13] 389-ds-base 2.4.4+dfsg1-3 MIGRATED to testing (Debian testing watch)
[2024-02-13] 389-ds-base 2.4.4+dfsg1-3 MIGRATED to testing (Debian testing watch)
[2024-02-10] Accepted 389-ds-base 2.4.4+dfsg1-3 (source) into unstable (Timo Aaltonen)
[2024-01-08] Accepted 389-ds-base 2.4.4+dfsg1-1 (source) into unstable (Timo Aaltonen)
[2023-12-30] 389-ds-base 2.3.4+dfsg1-1.1 MIGRATED to testing (Debian testing watch)
[2023-12-28] Accepted 389-ds-base 2.3.4+dfsg1-1.1 (source) into unstable (Bo YU) (signed by: bage@debian.org)
[2023-11-10] 389-ds-base REMOVED from testing (Debian testing watch)
[2023-07-01] 389-ds-base 2.3.4+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2023-07-01] 389-ds-base 2.3.4+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2023-06-19] Accepted 389-ds-base 2.3.4+dfsg1-1 (source) into unstable (Timo Aaltonen)
[2023-04-24] Accepted 389-ds-base 1.4.0.21-1+deb10u1 (source) into oldstable (Anton Gladky)
[2023-01-26] 389-ds-base 2.3.1+dfsg1-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 13
RC: 2
I&N: 9
M&W: 2
F&P: 0
patch: 0

links

homepage
lintian (0, 53)
buildd: logs, cross
popcon
browse source code
other distros
security tracker
l10n (-, 100)
debian patches
debci