389-users September 2026

389-users@lists.fedoraproject.org

2 participants
4 discussions

Start a nNew thread

Security updates required for recent 389 Directory Server releases
by Viktor Ashirov 14 Sep '26

14 Sep '26

2 1

Announcing 389 Directory Server 3.3.1 (F45/F46)
by Viktor Ashirov 10 Sep '26

10 Sep '26

389 Directory Server 3.3.1 The 389 Directory Server team is proud to announce 389-ds-base version 3.3.1. Source tarball: - https://github.com/389ds/389-ds-base/releases/download/389-ds-base- 3.3.1/389-ds-base-3.3.1.tar.bz2 <https://github.com/389ds/389-ds-base/releases/download/389-ds-base-3.3.1/38…> Fedora updates: - Fedora 45: https://bodhi.fedoraproject.org/updates/FEDORA-2026-c1e25a4642 - Fedora 46/Rawhide: https://bodhi.fedoraproject.org/updates/FEDORA-2026-8f87416609 Highlights in 3.3.1 - Security fixes for CVE-2026-11770 <https://access.redhat.com/security/cve/CVE-2026-11770>, CVE-2026-18355 <https://access.redhat.com/security/cve/CVE-2026-18355>, CVE-2026-18453 <https://access.redhat.com/security/cve/CVE-2026-18453>, CVE-2026-18922 <https://access.redhat.com/security/cve/CVE-2026-18922>, CVE-2026-19843 <https://access.redhat.com/security/cve/CVE-2026-19843>, CVE-2026-76560 <https://access.redhat.com/security/cve/CVE-2026-76560>, and CVE -2026-9064 <https://access.redhat.com/security/cve/CVE-2026-9064>. - Add Have I Been Pwned password breach validation, sysusers.d support, and offline thread-pool saturation diagnostics. - Preserve dsEntryDN case on modify and prevent silent entry loss during LMDB bulk import. - Improve replication total initialization, deferred MemberOf updates, range searches, online reindex safety, and log-compression contention. - Strengthen PBKDF2 validation and fix memory-safety issues in LDAP parsing, ACL processing, password handling, and retro changelog operations. Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your DNF repositories. To install the server use dnf install 389-ds-base To install the Cockpit UI plugin use dnf install cockpit-389-ds After rpm install completes, run dscreate interactive For upgrades, simply install the package. There are no further steps required. See Install Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup. See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback Please provide feedback and comments here: - 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… - 389ds discussion channel: https://github.com/389ds/389-ds-base/discussions If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base Changelog between 389-ds-base-3.3.0 and 389-ds-base-3.3.1: - Bump version to 3.3.1 - Security fix for CVE-2026-76560 <https://access.redhat.com/security/cve/CVE-2026-76560> - Security fix for CVE-2026-19843 <https://access.redhat.com/security/cve/CVE-2026-19843> - Security fix for CVE-2026-18922 <https://access.redhat.com/security/cve/CVE-2026-18922> - Security fix for CVE-2026-18453 <https://access.redhat.com/security/cve/CVE-2026-18453> - Security fix for CVE-2026-18355 <https://access.redhat.com/security/cve/CVE-2026-18355> - Issue 7806 <https://github.com/389ds/389-ds-base/issues/7806> - Preserve dsEntryDN case on modify #7807 <https://github.com/389ds/389-ds-base/pull/7807> - Issue 7808 <https://github.com/389ds/389-ds-base/issues/7808> - CI - harden online_import_nosync_test #7809 <https://github.com/389ds/389-ds-base/pull/7809> - Bump fast-uri from 3.1.5 to 3.1.7 in /src/cockpit/389-console - Issue 7595 <https://github.com/389ds/389-ds-base/issues/7595> - Remove the nightly dedup gate and fix dispatched test runs #7792 <https://github.com/389ds/389-ds-base/pull/7792> - Issue 7611 <https://github.com/389ds/389-ds-base/issues/7611> - PBKDF2 password verification should reject invalid iteration counts #7632 <https://github.com/389ds/389-ds-base/pull/7632> - Issue 7785 <https://github.com/389ds/389-ds-base/issues/7785> - Downstream release automation using Packit #7786 <https://github.com/389ds/389-ds-base/pull/7786> - Issue 2779 <https://github.com/389ds/389-ds-base/issues/2779> - Streamline SPEC file for potential inclusion in Fedora #7784 <https://github.com/389ds/389-ds-base/pull/7784> - Issue 7769 <https://github.com/389ds/389-ds-base/issues/7769> - Password may wrongly be reported as expired #7777 <https://github.com/389ds/389-ds-base/pull/7777> - Update Rust crate uuid to v1.26.0 - Update dependency eslint to v10.9.1 - Update github-actions - Reject mismatched cn in dynamic certificate add requests #7680 <https://github.com/389ds/389-ds-base/pull/7680> - Fix expiration time check #7718 <https://github.com/389ds/389-ds-base/pull/7718> - Issue 7722 <https://github.com/389ds/389-ds-base/issues/7722> - Switch to logconv.py as default #7778 <https://github.com/389ds/389-ds-base/pull/7778> - Issue 6176 <https://github.com/389ds/389-ds-base/issues/6176> - Add sysusers.d support and modernize systemd path detection #7776 <https://github.com/389ds/389-ds-base/pull/7776> - Issue 7774 <https://github.com/389ds/389-ds-base/issues/7774> - Add backport action #7775 <https://github.com/389ds/389-ds-base/pull/7775> - Issue 7770 <https://github.com/389ds/389-ds-base/issues/7770> - Testimony failure in test_cleanruv_extop_security.py #7771 <https://github.com/389ds/389-ds-base/pull/7771> - CVE-2026-11770 <https://access.redhat.com/security/cve/CVE-2026-11770> - Fix StartReplicationRequest auth gate response format - Security fix for CVE-2026-11770 <https://access.redhat.com/security/cve/CVE-2026-11770> - Issue 7595 <https://github.com/389ds/389-ds-base/issues/7595> - Run PR tests when the nightly gate is skipped #7766 <https://github.com/389ds/389-ds-base/pull/7766> - Issue 7760 <https://github.com/389ds/389-ds-base/issues/7760> - CI - harden dsconf_task_test.py - Update rust-dependencies to v1.4.4 - Issue 7764 <https://github.com/389ds/389-ds-base/issues/7764> - Remove stale Cargo.lock #7765 <https://github.com/389ds/389-ds-base/pull/7765> - Issue 4701 <https://github.com/389ds/389-ds-base/issues/4701> - Fix UAF when excluding attrs from retro changelog #7730 <https://github.com/389ds/389-ds-base/pull/7730> - Update github/codeql-action digest to db488dd - Update cockpit-389-ds-npm - Issue 7723 <https://github.com/389ds/389-ds-base/issues/7723> - Range search returns an empty result when its start key is removed #7724 <https://github.com/389ds/389-ds-base/pull/7724> - Issue 7728 <https://github.com/389ds/389-ds-base/issues/7728> - bdb: Fix nsslapd-db-compactdb-interval: 0 not disabling auto compaction - Issue 7639 <https://github.com/389ds/389-ds-base/issues/7639> - Move log compression outside of global write lock - Issue 7595 <https://github.com/389ds/389-ds-base/issues/7595> - Skip redundant CI runs to relieve the Actions queue #7717 <https://github.com/389ds/389-ds-base/pull/7717> - Issue 7631 <https://github.com/389ds/389-ds-base/issues/7631> - Don’t install bpftrace by default #7726 <https://github.com/389ds/389-ds-base/pull/7726> - Issue 7735 <https://github.com/389ds/389-ds-base/issues/7735> - Heap overflow when parsing objectclass superior #7736 <https://github.com/389ds/389-ds-base/pull/7736> - Issue 7733 <https://github.com/389ds/389-ds-base/issues/7733> - Typo about nsuniqueid in tombstone_to_conflict #7734 <https://github.com/389ds/389-ds-base/pull/7734> - Update rust-dependencies - Issue 3555 <https://github.com/389ds/389-ds-base/issues/3555> - UI - Fix audit issue with npm - fast-uri, js-yaml, nanoid #7700 <https://github.com/389ds/389-ds-base/pull/7700> - Issue 7707 <https://github.com/389ds/389-ds-base/issues/7707> - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer #7708 <https://github.com/389ds/389-ds-base/pull/7708> - Issue 7679 <https://github.com/389ds/389-ds-base/issues/7679> - Add layered agent docs, task skills, and guides #7686 <https://github.com/389ds/389-ds-base/pull/7686> - Issue 7688 <https://github.com/389ds/389-ds-base/issues/7688> - BUG - partial address leak in sso token #7689 <https://github.com/389ds/389-ds-base/pull/7689> - Issue 7705 <https://github.com/389ds/389-ds-base/issues/7705> - With memberOfEntryScope set, deferred memberOf skips MODIFY operations #7706 <https://github.com/389ds/389-ds-base/pull/7706> - Issue 7698 <https://github.com/389ds/389-ds-base/issues/7698> - Fix silent entry loss in LMDB bulk import waiter handling #7699 <https://github.com/389ds/389-ds-base/pull/7699> - Issue 7711 <https://github.com/389ds/389-ds-base/issues/7711> - Fix typo in accountpolicy –login-history-size help text #7713 <https://github.com/389ds/389-ds-base/pull/7713> - Issue 6419 <https://github.com/389ds/389-ds-base/issues/6419> - Error: name ‘cockpit_present’ is not defined #7719 <https://github.com/389ds/389-ds-base/pull/7719> - Update github-actions - Issue 7709 <https://github.com/389ds/389-ds-base/issues/7709> - Add EPEL 10 target to Packit COPR builds #7721 <https://github.com/389ds/389-ds-base/pull/7721> - Issue 7666 <https://github.com/389ds/389-ds-base/issues/7666> - Replication performance degradation during total init on high-latency storage #7667 <https://github.com/389ds/389-ds-base/pull/7667> - Issue 7645 <https://github.com/389ds/389-ds-base/issues/7645> - Add runtime LeakSanitizer leak check #7646 <https://github.com/389ds/389-ds-base/pull/7646> - Issue 7273 <https://github.com/389ds/389-ds-base/issues/7273> - In a chaining environment binding as remote user causes an invalid error in the logs - Issue 7709 <https://github.com/389ds/389-ds-base/issues/7709> - Add EPEL 10 target to Packit COPR builds - Issue 7714 <https://github.com/389ds/389-ds-base/issues/7714> - UI - sass import rules are deprecated - Issue 7658 <https://github.com/389ds/389-ds-base/issues/7658> - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND - Issue 7710 <https://github.com/389ds/389-ds-base/issues/7710> - MemberOf deferred update - Use condvar instead of sleep loop - Issue 7637 <https://github.com/389ds/389-ds-base/issues/7637> - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload - Issue 7685 <https://github.com/389ds/389-ds-base/issues/7685> - BUG - Avoid ioblocktimeout #7687 <https://github.com/389ds/389-ds-base/pull/7687> - Issue 7578 <https://github.com/389ds/389-ds-base/issues/7578> - schema - attribute refcount is not maintained properly - Issue 7468 <https://github.com/389ds/389-ds-base/issues/7468> - RFE - HIBP password breach validation #7492 <https://github.com/389ds/389-ds-base/pull/7492> - Issue 7605 <https://github.com/389ds/389-ds-base/issues/7605> - Harden CI test ports against ephemeral allocation #7692 <https://github.com/389ds/389-ds-base/pull/7692> - Issue 7528 <https://github.com/389ds/389-ds-base/issues/7528> - Retry the CI image pull instead of failing the job #7691 <https://github.com/389ds/389-ds-base/pull/7691> - Backport Issue 7519 <https://github.com/389ds/389-ds-base/issues/7519> — ignore obsolete entrydn when entryrdn is in use #7657 <https://github.com/389ds/389-ds-base/pull/7657> - Update cockpit-389-ds-npm #7565 <https://github.com/389ds/389-ds-base/pull/7565> - Issue 7466 <https://github.com/389ds/389-ds-base/issues/7466> - UI - Refactor all TextInput number types to NumberInput - Migrate pwdchan to base64 0.23 Engine API - Update rust-dependencies - Update rust-dependencies #7669 <https://github.com/389ds/389-ds-base/pull/7669> - Issue 7505 <https://github.com/389ds/389-ds-base/issues/7505> - RFE - CLI - add feature to determine which password policy applies to a user - Issue 7652 <https://github.com/389ds/389-ds-base/issues/7652> - Fix acl_test after fixing anonymous bind with password #7678 <https://github.com/389ds/389-ds-base/pull/7678> - Update github/codeql-action digest to f205ea1 - Issue 7675 <https://github.com/389ds/389-ds-base/issues/7675> - memory leak in test_libslapd_csngen_clock_failure- #7676 #7676 - Issue 7670 <https://github.com/389ds/389-ds-base/issues/7670> - BDB range searches intermittently fail with err=1 under write load #7671 <https://github.com/389ds/389-ds-base/pull/7671> - Issue 7652 <https://github.com/389ds/389-ds-base/issues/7652> - change bind result with password but no dn #7653 <https://github.com/389ds/389-ds-base/pull/7653> - Issue 7284 <https://github.com/389ds/389-ds-base/issues/7284> - Creating local password policy succeeds with incorrect passwordInHistory value #7662 <https://github.com/389ds/389-ds-base/pull/7662> - Issue 7200 <https://github.com/389ds/389-ds-base/issues/7200> - repl-agmt create doesn’t set some parameters #7663 <https://github.com/389ds/389-ds-base/pull/7663> - Update rust-dependencies #7472 <https://github.com/389ds/389-ds-base/pull/7472> - Pin dependencies - Update actions/checkout action to v7 - Update Rust crate openssl to v0.10.80 [SECURITY] - Issue 7327 <https://github.com/389ds/389-ds-base/issues/7327> - Unify topology naming in tests #7650 <https://github.com/389ds/389-ds-base/pull/7650> - Issue 7633 <https://github.com/389ds/389-ds-base/issues/7633> - RFE - Add offline diagnostics for thread pool saturation #7634 <https://github.com/389ds/389-ds-base/pull/7634> - Issue 7611 <https://github.com/389ds/389-ds-base/issues/7611> - Preserve legacy PBKDF2 hash compatibility #7649 <https://github.com/389ds/389-ds-base/pull/7649> - Issue 7547 <https://github.com/389ds/389-ds-base/issues/7547> - Heap buffer overflow in ldap_utf8prev() - Issue 7543 <https://github.com/389ds/389-ds-base/issues/7543> - buffer overflow in slapi_dn_find_parent_ext() #7544 <https://github.com/389ds/389-ds-base/pull/7544> - Issue 7545 <https://github.com/389ds/389-ds-base/issues/7545> - Heap buffer overflow in str2entry_state_information_from_type() #7546 <https://github.com/389ds/389-ds-base/pull/7546> - Issue 7569 <https://github.com/389ds/389-ds-base/issues/7569> - Reduce noisy CodeQL false-positive alerts #7629 <https://github.com/389ds/389-ds-base/pull/7629> - Issue 7611 <https://github.com/389ds/389-ds-base/issues/7611> - PBKDF2 password verification should reject invalid iteration count #7613 <https://github.com/389ds/389-ds-base/pull/7613> - Issue 7535 <https://github.com/389ds/389-ds-base/issues/7535> - Fix race in test_schema_update_policy_reject - Issue 7595 <https://github.com/389ds/389-ds-base/issues/7595> - Reduce Actions queue saturation #7596 <https://github.com/389ds/389-ds-base/pull/7596> - Issue 7558 <https://github.com/389ds/389-ds-base/issues/7558> - Total init sends the suffix entry twice #7640 <https://github.com/389ds/389-ds-base/pull/7640> - Issue 7147 <https://github.com/389ds/389-ds-base/issues/7147> - Fix DN cache ownership during online reindex #7641 <https://github.com/389ds/389-ds-base/pull/7641> - Issue 7635 <https://github.com/389ds/389-ds-base/issues/7635> - Integer Underflow in {SMD5} Password Comparison #7636 <https://github.com/389ds/389-ds-base/pull/7636> - Issue 7284 <https://github.com/389ds/389-ds-base/issues/7284> - Automated test for creating local password policy with incorrect passwordInHistory value #7608 <https://github.com/389ds/389-ds-base/pull/7608> - Issue 7406 <https://github.com/389ds/389-ds-base/issues/7406> - Fix ldap-agent SNMP stats file loading #7630 <https://github.com/389ds/389-ds-base/pull/7630> - Issue 7621 <https://github.com/389ds/389-ds-base/issues/7621> - Stack Buffer Overflow in Password checkPrefix - Issue 7623 <https://github.com/389ds/389-ds-base/issues/7623> - Heap Buffer Overflow in 389-ds-base Audit Log Password Masking - Issue 7569 <https://github.com/389ds/389-ds-base/issues/7569> - Add CodeQL advanced setup workflow #7570 <https://github.com/389ds/389-ds-base/pull/7570> - Issue 7536 <https://github.com/389ds/389-ds-base/issues/7536> - CI - Fix backup_task_after_failure race #7588 <https://github.com/389ds/389-ds-base/pull/7588> - Issue 7610 <https://github.com/389ds/389-ds-base/issues/7610> - Still some lib389.topologies in CI tests #7612 <https://github.com/389ds/389-ds-base/pull/7612> - Issue 7529 <https://github.com/389ds/389-ds-base/issues/7529> - Fix Web UI local policy availability test #7609 <https://github.com/389ds/389-ds-base/pull/7609> - Issue 7617 <https://github.com/389ds/389-ds-base/issues/7617> - Fix wrong PR_ASSERT about entry cache #7618 <https://github.com/389ds/389-ds-base/pull/7618> - Issue 7602 <https://github.com/389ds/389-ds-base/issues/7602> - CI - lib389 user compare fails due to parentid mismatch #7603 <https://github.com/389ds/389-ds-base/pull/7603> - Issue 7380 <https://github.com/389ds/389-ds-base/issues/7380> - Automated test for negative wtime #7616 <https://github.com/389ds/389-ds-base/pull/7616> - Issue 7147 <https://github.com/389ds/389-ds-base/issues/7147> - entrycache_eviction_test CI test is failing #7607 <https://github.com/389ds/389-ds-base/pull/7607> - Issue 7537 <https://github.com/389ds/389-ds-base/issues/7537> - CI - Fix replication log monitoring parser/timing failures #7592 <https://github.com/389ds/389-ds-base/pull/7592> - Issue 7593 <https://github.com/389ds/389-ds-base/issues/7593> - Fix testimony docstring for SASL overflow test #7606 <https://github.com/389ds/389-ds-base/pull/7606> - Issue 7583 <https://github.com/389ds/389-ds-base/issues/7583> - Compressed logs are prematurely deleted #7584 <https://github.com/389ds/389-ds-base/pull/7584> - Issue 7530 <https://github.com/389ds/389-ds-base/issues/7530> - CI - Stabilize DNA plugin replication tests timing out in CI #7572 <https://github.com/389ds/389-ds-base/pull/7572> - Issue 7567 <https://github.com/389ds/389-ds-base/issues/7567> - Content Sync plugin unbounded queue growth and race conditions #7568 <https://github.com/389ds/389-ds-base/pull/7568> - Issue 7593 <https://github.com/389ds/389-ds-base/issues/7593> - Reject invalid SASL packet length values in sasl_io_start_packet #7594 <https://github.com/389ds/389-ds-base/pull/7594> - Issue 3555 <https://github.com/389ds/389-ds-base/issues/3555> - UI - Fix audit issue with npm - ws, js-yaml, babel/core #7599 <https://github.com/389ds/389-ds-base/pull/7599> - Issue 7263 <https://github.com/389ds/389-ds-base/issues/7263> - UI - Use cockpit.file API for temporary file writes #7590 <https://github.com/389ds/389-ds-base/pull/7590> - Issue 7541 <https://github.com/389ds/389-ds-base/issues/7541> - Add invalid ACL text header regression test #7591 <https://github.com/389ds/389-ds-base/pull/7591> - Issue 7554 <https://github.com/389ds/389-ds-base/issues/7554> - UI - Revise local password policy layout - Issue 7521 <https://github.com/389ds/389-ds-base/issues/7521> - UI - make changes for cockpit API updates - Issue 7529 <https://github.com/389ds/389-ds-base/issues/7529> - Fix Web UI CI failure cascade and missing screenshots #7566 <https://github.com/389ds/389-ds-base/pull/7566> - Issue 7541 <https://github.com/389ds/389-ds-base/issues/7541> - heap-buffer-overflows in __aclp__normalize_acltxt() #7542 <https://github.com/389ds/389-ds-base/pull/7542> - Issue 7534 <https://github.com/389ds/389-ds-base/issues/7534> - CI - Fix resource_limits fdlimits failures in BDB and LMDB #7585 <https://github.com/389ds/389-ds-base/pull/7585> - Issue 6753 <https://github.com/389ds/389-ds-base/issues/6753> - Port ticket 48392 test #7523 <https://github.com/389ds/389-ds-base/pull/7523> - Issue 7531 <https://github.com/389ds/389-ds-base/issues/7531> - Fix LMDB replication regression_m2 failures and core dumps #7575 <https://github.com/389ds/389-ds-base/pull/7575> - Issue 7490 <https://github.com/389ds/389-ds-base/issues/7490> - Enable USDT probes by default in RPM #7491 <https://github.com/389ds/389-ds-base/pull/7491> - Issue 7576 <https://github.com/389ds/389-ds-base/issues/7576> - Fix leak of temporary attribute syntax hash tables after schema reload - Issue 7573 <https://github.com/389ds/389-ds-base/issues/7573> - Post-import cache autotuning does not recompute entry cache size #7574 <https://github.com/389ds/389-ds-base/pull/7574> - Issue 7558 <https://github.com/389ds/389-ds-base/issues/7558> - During online import, the IDL should be created with in-depth first approach #7559 <https://github.com/389ds/389-ds-base/pull/7559> - Issue 7500 <https://github.com/389ds/389-ds-base/issues/7500> - Prevent unsigned integer underflow during stalled import - Issue 7562 <https://github.com/389ds/389-ds-base/issues/7562> - Error: NssSsl.add_cert() got an unexpected keyword argument ‘input_file’ #7563 <https://github.com/389ds/389-ds-base/pull/7563> - Issue 7560 <https://github.com/389ds/389-ds-base/issues/7560> - lib389 - Add helper function for checking ASAN files - Issue 7539 <https://github.com/389ds/389-ds-base/issues/7539> - Server shutdown during online reindex may lead to data loss #7540 <https://github.com/389ds/389-ds-base/pull/7540> - Issue 7549 <https://github.com/389ds/389-ds-base/issues/7549> - Substring index should validate minimum nsSubStrBegin/nsSubStrEnd values #7550 <https://github.com/389ds/389-ds-base/pull/7550> - Issue 3555 <https://github.com/389ds/389-ds-base/issues/3555> - UI - Fix audit issue with npm - brace-expansion #7556 <https://github.com/389ds/389-ds-base/pull/7556> - Issue 7554 <https://github.com/389ds/389-ds-base/issues/7554> - deref plugin null pointer dereference if ber_init fails - Issue 7532 <https://github.com/389ds/389-ds-base/issues/7532> - CI - Fix BDB CLU dbmon tests leaving instance offline #7553 <https://github.com/389ds/389-ds-base/pull/7553> - Issue 7391 <https://github.com/389ds/389-ds-base/issues/7391> - Harden systemd service unit #7392 <https://github.com/389ds/389-ds-base/pull/7392>

1 0

Announcing 389 Directory Server 3.2.3 (F44)
by Viktor Ashirov 10 Sep '26

10 Sep '26

389 Directory Server 3.2.3 The 389 Directory Server team is proud to announce 389-ds-base version 3.2.3. Source tarball: - https://github.com/389ds/389-ds-base/releases/download/389-ds-base-3.2.3/38… Fedora 44 update: https://bodhi.fedoraproject.org/updates/FEDORA-2026-b16c9cbc0f Highlights in 3.2.3 - Security fixes for CVE-2026-11770 <https://access.redhat.com/security/cve/CVE-2026-11770>, CVE-2026-18355 <https://access.redhat.com/security/cve/CVE-2026-18355>, CVE-2026-18453 <https://access.redhat.com/security/cve/CVE-2026-18453>, CVE-2026-18922 <https://access.redhat.com/security/cve/CVE-2026-18922>, CVE-2026-19843 <https://access.redhat.com/security/cve/CVE-2026-19843>, CVE-2026-76560 <https://access.redhat.com/security/cve/CVE-2026-76560>. - Add sysusers.d support, modern systemd path detection, and dynamic-certificate request validation. - Add Have I Been Pwned password breach validation and offline thread-pool saturation diagnostics. - Prevent silent entry loss during LMDB bulk import and improve replication total initialization on high-latency storage. - Strengthen PBKDF2 validation, deferred MemberOf updates, range searches, and online reindex safety. See Download <https://www.port389.org/docs/389ds/download.html> for package installation and Install Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for setup. Changelog between 389-ds-base-3.2.2 and 389-ds-base-3.2.3: - Bump version to 3.2.3 - Security fix for CVE-2026-76560 <https://access.redhat.com/security/cve/CVE-2026-76560> - Security fix for CVE-2026-19843 <https://access.redhat.com/security/cve/CVE-2026-19843> - Security fix for CVE-2026-18922 <https://access.redhat.com/security/cve/CVE-2026-18922> - Security fix for CVE-2026-18453 <https://access.redhat.com/security/cve/CVE-2026-18453> - Security fix for CVE-2026-18355 <https://access.redhat.com/security/cve/CVE-2026-18355> - Issue 7808 <https://github.com/389ds/389-ds-base/issues/7808> - CI - harden online_import_nosync_test #7809 <https://github.com/389ds/389-ds-base/pull/7809> - Issue 7595 <https://github.com/389ds/389-ds-base/issues/7595> - Remove the nightly dedup gate and fix dispatched test runs - Migrate pwdchan to base64 0.23 Engine API - Update rust-dependencies - Issue 7611 <https://github.com/389ds/389-ds-base/issues/7611> - PBKDF2 password verification should reject invalid iteration counts #7632 <https://github.com/389ds/389-ds-base/pull/7632> - Issue 6176 <https://github.com/389ds/389-ds-base/issues/6176> - Add sysusers.d support and modernize systemd path detection #7776 <https://github.com/389ds/389-ds-base/pull/7776> - Reject mismatched cn in dynamic certificate add requests #7680 <https://github.com/389ds/389-ds-base/pull/7680> - Fix expiration time check #7718 <https://github.com/389ds/389-ds-base/pull/7718> - Issue 7774 <https://github.com/389ds/389-ds-base/issues/7774> - Add backport action #7775 <https://github.com/389ds/389-ds-base/pull/7775> - Issue 7770 <https://github.com/389ds/389-ds-base/issues/7770> - Testimony failure in test_cleanruv_extop_security.py #7771 <https://github.com/389ds/389-ds-base/pull/7771> - CVE-2026-11770 <https://access.redhat.com/security/cve/CVE-2026-11770> - Fix StartReplicationRequest auth gate response format - Security fix for CVE-2026-11770 <https://access.redhat.com/security/cve/CVE-2026-11770> - Issue 7595 <https://github.com/389ds/389-ds-base/issues/7595> - Skip redundant CI runs to relieve the Actions queue #7747 <https://github.com/389ds/389-ds-base/pull/7747> - Issue 7760 <https://github.com/389ds/389-ds-base/issues/7760> - CI - harden dsconf_task_test.py - Issue 4701 <https://github.com/389ds/389-ds-base/issues/4701> - Fix UAF when excluding attrs from retro changelog #7730 <https://github.com/389ds/389-ds-base/pull/7730> - Issue 7723 <https://github.com/389ds/389-ds-base/issues/7723> - Range search returns an empty result when its start key is removed #7724 <https://github.com/389ds/389-ds-base/pull/7724> - Issue 7639 <https://github.com/389ds/389-ds-base/issues/7639> - Move log compression outside of global write lock - Issue 7631 <https://github.com/389ds/389-ds-base/issues/7631> - Don’t install bpftrace by default #7726 <https://github.com/389ds/389-ds-base/pull/7726> - Issue 7735 <https://github.com/389ds/389-ds-base/issues/7735> - Heap overflow when parsing objectclass superior #7736 <https://github.com/389ds/389-ds-base/pull/7736> - Issue 7733 <https://github.com/389ds/389-ds-base/issues/7733> - Typo about nsuniqueid in tombstone_to_conflict #7734 <https://github.com/389ds/389-ds-base/pull/7734> - Issue 7707 <https://github.com/389ds/389-ds-base/issues/7707> - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer #7708 <https://github.com/389ds/389-ds-base/pull/7708> - Issue 7688 <https://github.com/389ds/389-ds-base/issues/7688> - BUG - partial address leak in sso token #7689 <https://github.com/389ds/389-ds-base/pull/7689> - Issue 7705 <https://github.com/389ds/389-ds-base/issues/7705> - With memberOfEntryScope set, deferred memberOf skips MODIFY operations #7706 <https://github.com/389ds/389-ds-base/pull/7706> - Issue 7698 <https://github.com/389ds/389-ds-base/issues/7698> - Fix silent entry loss in LMDB bulk import waiter handling #7699 <https://github.com/389ds/389-ds-base/pull/7699> - Issue 7711 <https://github.com/389ds/389-ds-base/issues/7711> - Fix typo in accountpolicy –login-history-size help text #7713 <https://github.com/389ds/389-ds-base/pull/7713> - Issue 6419 <https://github.com/389ds/389-ds-base/issues/6419> - Error: name ‘cockpit_present’ is not defined #7719 <https://github.com/389ds/389-ds-base/pull/7719> - Issue 7666 <https://github.com/389ds/389-ds-base/issues/7666> - Replication performance degradation during total init on high-latency storage #7667 <https://github.com/389ds/389-ds-base/pull/7667> - Issue 7645 <https://github.com/389ds/389-ds-base/issues/7645> - Add runtime LeakSanitizer leak check #7646 <https://github.com/389ds/389-ds-base/pull/7646> - Issue 7709 <https://github.com/389ds/389-ds-base/issues/7709> - Add EPEL 10 target to Packit COPR builds - Issue 7714 <https://github.com/389ds/389-ds-base/issues/7714> - UI - sass import rules are deprecated - Issue 7658 <https://github.com/389ds/389-ds-base/issues/7658> - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND - Issue 7710 <https://github.com/389ds/389-ds-base/issues/7710> - MemberOf deferred update - Use condvar instead of sleep loop - Issue 7637 <https://github.com/389ds/389-ds-base/issues/7637> - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload - Issue 7578 <https://github.com/389ds/389-ds-base/issues/7578> - schema - attribute refcount is not maintained properly - Issue 7468 <https://github.com/389ds/389-ds-base/issues/7468> - RFE - HIBP password breach validation #7492 <https://github.com/389ds/389-ds-base/pull/7492> - Issue 7605 <https://github.com/389ds/389-ds-base/issues/7605> - Harden CI test ports against ephemeral allocation #7692 <https://github.com/389ds/389-ds-base/pull/7692> - Issue 7528 <https://github.com/389ds/389-ds-base/issues/7528> - Retry the CI image pull instead of failing the job #7691 <https://github.com/389ds/389-ds-base/pull/7691> - Backport Issue 7519 <https://github.com/389ds/389-ds-base/issues/7519> — ignore obsolete entrydn when entryrdn is in use #7657 <https://github.com/389ds/389-ds-base/pull/7657> - Issue 7466 <https://github.com/389ds/389-ds-base/issues/7466> - UI - Refactor all TextInput number types to NumberInput - Issue 7505 <https://github.com/389ds/389-ds-base/issues/7505> - RFE - CLI - add feature to determine which password policy applies to a user - Issue 7670 <https://github.com/389ds/389-ds-base/issues/7670> - BDB range searches intermittently fail with err=1 under write load #7671 <https://github.com/389ds/389-ds-base/pull/7671> - Issue 7284 <https://github.com/389ds/389-ds-base/issues/7284> - Creating local password policy succeeds with incorrect passwordInHistory value #7662 <https://github.com/389ds/389-ds-base/pull/7662> - Issue 7284 <https://github.com/389ds/389-ds-base/issues/7284> - Automated test for creating local password policy with incorrect passwordInHistory value #7608 <https://github.com/389ds/389-ds-base/pull/7608> - Issue 7200 <https://github.com/389ds/389-ds-base/issues/7200> - repl-agmt create doesn’t set some parameters #7663 <https://github.com/389ds/389-ds-base/pull/7663> - Issue 7573 <https://github.com/389ds/389-ds-base/issues/7573> - Post-import cache autotuning does not recompute entry cache size #7574 <https://github.com/389ds/389-ds-base/pull/7574> - Issue 7611 <https://github.com/389ds/389-ds-base/issues/7611> - Preserve legacy PBKDF2 hash compatibility #7649 <https://github.com/389ds/389-ds-base/pull/7649> - Issue 7547 <https://github.com/389ds/389-ds-base/issues/7547> - Heap buffer overflow in ldap_utf8prev() - Issue 7611 <https://github.com/389ds/389-ds-base/issues/7611> - PBKDF2 password verification should reject invalid iteration count #7613 <https://github.com/389ds/389-ds-base/pull/7613> - Issue 7535 <https://github.com/389ds/389-ds-base/issues/7535> - Fix race in test_schema_update_policy_reject - Issue 7558 <https://github.com/389ds/389-ds-base/issues/7558> - Total init sends the suffix entry twice #7640 <https://github.com/389ds/389-ds-base/pull/7640> - Issue 7635 <https://github.com/389ds/389-ds-base/issues/7635> - Integer Underflow in {SMD5} Password Comparison #7636 <https://github.com/389ds/389-ds-base/pull/7636> - Issue 7406 <https://github.com/389ds/389-ds-base/issues/7406> - Fix ldap-agent SNMP stats file loading #7630 <https://github.com/389ds/389-ds-base/pull/7630> - Issue 7621 <https://github.com/389ds/389-ds-base/issues/7621> - Stack Buffer Overflow in Password checkPrefix - Issue 7623 <https://github.com/389ds/389-ds-base/issues/7623> - Heap Buffer Overflow in 389-ds-base Audit Log Password Masking - Issue 7602 <https://github.com/389ds/389-ds-base/issues/7602> - CI - lib389 user compare fails due to parentid mismatch #7603 <https://github.com/389ds/389-ds-base/pull/7603> - Issue 3555 <https://github.com/389ds/389-ds-base/issues/3555> - UI - Fix audit issue with npm - ws, js-yaml, babel/core #7599 <https://github.com/389ds/389-ds-base/pull/7599> - Issue 7263 <https://github.com/389ds/389-ds-base/issues/7263> - UI - Use cockpit.file API for temporary file writes #7590 <https://github.com/389ds/389-ds-base/pull/7590> - Issue 7541 <https://github.com/389ds/389-ds-base/issues/7541> - Add invalid ACL text header regression test #7591 <https://github.com/389ds/389-ds-base/pull/7591> - Issue 7554 <https://github.com/389ds/389-ds-base/issues/7554> - UI - Revise local password policy layout - Issue 7521 <https://github.com/389ds/389-ds-base/issues/7521> - UI - make changes for cockpit API updates - Issue 7541 <https://github.com/389ds/389-ds-base/issues/7541> - heap-buffer-overflows in __aclp__normalize_acltxt() #7542 <https://github.com/389ds/389-ds-base/pull/7542> - Issue 7490 <https://github.com/389ds/389-ds-base/issues/7490> - Enable USDT probes by default in RPM #7491 <https://github.com/389ds/389-ds-base/pull/7491> - Issue 7576 <https://github.com/389ds/389-ds-base/issues/7576> - Fix leak of temporary attribute syntax hash tables after schema reload - Issue 7549 <https://github.com/389ds/389-ds-base/issues/7549> - Substring index should validate minimum nsSubStrBegin/nsSubStrEnd values #7550 <https://github.com/389ds/389-ds-base/pull/7550> - Issue 7539 <https://github.com/389ds/389-ds-base/issues/7539> - Server shutdown during online reindex may lead to data loss #7540 <https://github.com/389ds/389-ds-base/pull/7540> - Issue 7558 <https://github.com/389ds/389-ds-base/issues/7558> - During online import, the IDL should be created with in-depth first approach #7559 <https://github.com/389ds/389-ds-base/pull/7559> - Issue 7500 <https://github.com/389ds/389-ds-base/issues/7500> - Prevent unsigned integer underflow during stalled import - Issue 7562 <https://github.com/389ds/389-ds-base/issues/7562> - Error: NssSsl.add_cert() got an unexpected keyword argument ‘input_file’ #7563 <https://github.com/389ds/389-ds-base/pull/7563> - Issue 7560 <https://github.com/389ds/389-ds-base/issues/7560> - lib389 - Add helper function for checking ASAN files - Issue 3555 <https://github.com/389ds/389-ds-base/issues/3555> - UI - Fix audit issue with npm - brace-expansion #7556 <https://github.com/389ds/389-ds-base/pull/7556> - Issue 7554 <https://github.com/389ds/389-ds-base/issues/7554> - deref plugin null pointer dereference if ber_init fails

1 0

Announcing 389 Directory Server 3.1.5 (F43)
by Viktor Ashirov 10 Sep '26

10 Sep '26

389 Directory Server 3.1.5 The 389 Directory Server team is proud to announce 389-ds-base version 3.1.5. Source tarball: - https://github.com/389ds/389-ds-base/releases/download/389-ds-base-3.3.1/38… Fedora 43 update: https://bodhi.fedoraproject.org/updates/FEDORA-2026-0b8bc362b1 Highlights in 3.1.5 - Security fixes for CVE-2025-14905 <https://access.redhat.com/security/cve/CVE-2025-14905>, CVE-2026-11770 <https://access.redhat.com/security/cve/CVE-2026-11770>, CVE-2026-18355 <https://access.redhat.com/security/cve/CVE-2026-18355>, CVE-2026-18453 <https://access.redhat.com/security/cve/CVE-2026-18453>, CVE-2026-18922 <https://access.redhat.com/security/cve/CVE-2026-18922>, CVE-2026-19843 <https://access.redhat.com/security/cve/CVE-2026-19843>, CVE-2026-76560 <https://access.redhat.com/security/cve/CVE-2026-76560>, CVE-2026-9064 <https://access.redhat.com/security/cve/CVE-2026-9064>. - Fix bundled jemalloc builds with GCC 15. - Prevent silent entry loss during LMDB bulk import and improve replication total initialization on high-latency storage. - Strengthen PBKDF2 validation, deferred MemberOf updates, range searches, and online reindex safety. - Reduce log-compression lock contention and improve password policy, cache autotuning, and CLI diagnostics. See Download <https://www.port389.org/docs/389ds/download.html> for package installation and Install Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for setup. Changelog between 389-ds-base-3.1.4 and 389-ds-base-3.1.5: - Bump version to 3.1.5 - Security fix for CVE-2026-76560 <https://access.redhat.com/security/cve/CVE-2026-76560> - Security fix for CVE-2026-19843 <https://access.redhat.com/security/cve/CVE-2026-19843> - Security fix for CVE-2026-18922 <https://access.redhat.com/security/cve/CVE-2026-18922> - Security fix for CVE-2026-18453 <https://access.redhat.com/security/cve/CVE-2026-18453> - Security fix for CVE-2026-18355 <https://access.redhat.com/security/cve/CVE-2026-18355> - Issue 7178 <https://github.com/389ds/389-ds-base/issues/7178> - Bundled jemalloc fails to build with GCC 15 #7216 <https://github.com/389ds/389-ds-base/pull/7216> - Issue 7808 <https://github.com/389ds/389-ds-base/issues/7808> - CI - harden online_import_nosync_test #7809 <https://github.com/389ds/389-ds-base/pull/7809> - Issue 7595 <https://github.com/389ds/389-ds-base/issues/7595> - Remove the nightly dedup gate and fix dispatched test runs - [Backport 389-ds-base-3.1] Update rust-dependencies #7790 <https://github.com/389ds/389-ds-base/pull/7790> - Fix expiration time check #7718 <https://github.com/389ds/389-ds-base/pull/7718> - Issue 7774 <https://github.com/389ds/389-ds-base/issues/7774> - Add backport action #7775 <https://github.com/389ds/389-ds-base/pull/7775> - Issue 7770 <https://github.com/389ds/389-ds-base/issues/7770> - Testimony failure in test_cleanruv_extop_security.py #7771 <https://github.com/389ds/389-ds-base/pull/7771> - CVE-2026-11770 <https://access.redhat.com/security/cve/CVE-2026-11770> - Fix StartReplicationRequest auth gate response format - Security fix for CVE-2026-11770 <https://access.redhat.com/security/cve/CVE-2026-11770> - Issue 3082 <https://github.com/389ds/389-ds-base/issues/3082> - Add test389.topologies compatibility shim for backports #7725 <https://github.com/389ds/389-ds-base/pull/7725> - Issue 7595 <https://github.com/389ds/389-ds-base/issues/7595> - Skip redundant CI runs to relieve the Actions queue #7748 <https://github.com/389ds/389-ds-base/pull/7748> - Issue 7760 <https://github.com/389ds/389-ds-base/issues/7760> - CI - harden dsconf_task_test.py - Issue 4701 <https://github.com/389ds/389-ds-base/issues/4701> - Fix UAF when excluding attrs from retro changelog #7730 <https://github.com/389ds/389-ds-base/pull/7730> - Issue 7723 <https://github.com/389ds/389-ds-base/issues/7723> - Range search returns an empty result when its start key is removed #7724 <https://github.com/389ds/389-ds-base/pull/7724> - Issue 7639 <https://github.com/389ds/389-ds-base/issues/7639> - Move log compression outside of global write lock - Issue 7631 <https://github.com/389ds/389-ds-base/issues/7631> - Don’t install bpftrace by default #7726 <https://github.com/389ds/389-ds-base/pull/7726> - Issue 7735 <https://github.com/389ds/389-ds-base/issues/7735> - Heap overflow when parsing objectclass superior #7736 <https://github.com/389ds/389-ds-base/pull/7736> - Issue 7733 <https://github.com/389ds/389-ds-base/issues/7733> - Typo about nsuniqueid in tombstone_to_conflict #7734 <https://github.com/389ds/389-ds-base/pull/7734> - Issue 7707 <https://github.com/389ds/389-ds-base/issues/7707> - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer #7708 <https://github.com/389ds/389-ds-base/pull/7708> - Issue 7711 <https://github.com/389ds/389-ds-base/issues/7711> - Fix typo in accountpolicy –login-history-size help text #7713 <https://github.com/389ds/389-ds-base/pull/7713> - Issue 7688 <https://github.com/389ds/389-ds-base/issues/7688> - BUG - partial address leak in sso token #7689 <https://github.com/389ds/389-ds-base/pull/7689> - Issue 7705 <https://github.com/389ds/389-ds-base/issues/7705> - With memberOfEntryScope set, deferred memberOf skips MODIFY operations #7706 <https://github.com/389ds/389-ds-base/pull/7706> - Issue 7698 <https://github.com/389ds/389-ds-base/issues/7698> - Fix silent entry loss in LMDB bulk import waiter handling #7699 <https://github.com/389ds/389-ds-base/pull/7699> - Issue 7666 <https://github.com/389ds/389-ds-base/issues/7666> - Replication performance degradation during total init on high-latency storage #7667 <https://github.com/389ds/389-ds-base/pull/7667> - Issue 7201 <https://github.com/389ds/389-ds-base/issues/7201> - Syscall overhead in LMDB import writer thread #7204 <https://github.com/389ds/389-ds-base/pull/7204> - Issue 7645 <https://github.com/389ds/389-ds-base/issues/7645> - Add runtime LeakSanitizer leak check #7646 <https://github.com/389ds/389-ds-base/pull/7646> - Revert “Issue NNNN - Range search returns an empty result when its start key is removed” - Issue NNNN - Range search returns an empty result when its start key is removed - Issue 7714 <https://github.com/389ds/389-ds-base/issues/7714> - UI - sass import rules are deprecated - Issue 7658 <https://github.com/389ds/389-ds-base/issues/7658> - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND - Issue 7710 <https://github.com/389ds/389-ds-base/issues/7710> - MemberOf deferred update - Use condvar instead of sleep loop - Issue 7637 <https://github.com/389ds/389-ds-base/issues/7637> - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload - Issue 7578 <https://github.com/389ds/389-ds-base/issues/7578> - schema - attribute refcount is not maintained properly - Issue 7605 <https://github.com/389ds/389-ds-base/issues/7605> - Harden CI test ports against ephemeral allocation #7692 <https://github.com/389ds/389-ds-base/pull/7692> - Issue 7528 <https://github.com/389ds/389-ds-base/issues/7528> - Retry the CI image pull instead of failing the job #7691 <https://github.com/389ds/389-ds-base/pull/7691> - Backport Issue 7519 <https://github.com/389ds/389-ds-base/issues/7519> — ignore obsolete entrydn when entryrdn is in use #7657 <https://github.com/389ds/389-ds-base/pull/7657> - Issue 7505 <https://github.com/389ds/389-ds-base/issues/7505> - RFE - CLI - add feature to determine which password policy applies to a user - Issue 7670 <https://github.com/389ds/389-ds-base/issues/7670> - BDB range searches intermittently fail with err=1 under write load #7671 <https://github.com/389ds/389-ds-base/pull/7671> - Issue 7284 <https://github.com/389ds/389-ds-base/issues/7284> - Creating local password policy succeeds with incorrect passwordInHistory value #7662 <https://github.com/389ds/389-ds-base/pull/7662> - Issue 7284 <https://github.com/389ds/389-ds-base/issues/7284> - Automated test for creating local password policy with incorrect passwordInHistory value #7608 <https://github.com/389ds/389-ds-base/pull/7608> - Issue 7200 <https://github.com/389ds/389-ds-base/issues/7200> - repl-agmt create doesn’t set some parameters #7663 <https://github.com/389ds/389-ds-base/pull/7663> - Issue 7573 <https://github.com/389ds/389-ds-base/issues/7573> - Post-import cache autotuning does not recompute entry cache size #7574 <https://github.com/389ds/389-ds-base/pull/7574> - Issue 7470 <https://github.com/389ds/389-ds-base/issues/7470> - dsctl localhost tls import-server-key-cert fails with ‘expected str, bytes or os.PathLike object, not NoneType’ #7477 <https://github.com/389ds/389-ds-base/pull/7477> - Issue 7611 <https://github.com/389ds/389-ds-base/issues/7611> - Preserve legacy PBKDF2 hash compatibility #7649 <https://github.com/389ds/389-ds-base/pull/7649> - Issue 7547 <https://github.com/389ds/389-ds-base/issues/7547> - Heap buffer overflow in ldap_utf8prev() - Issue 7611 <https://github.com/389ds/389-ds-base/issues/7611> - PBKDF2 password verification should reject invalid iteration count #7613 <https://github.com/389ds/389-ds-base/pull/7613> - Issue 7558 <https://github.com/389ds/389-ds-base/issues/7558> - Total init sends the suffix entry twice #7640 <https://github.com/389ds/389-ds-base/pull/7640> - Issue 7635 <https://github.com/389ds/389-ds-base/issues/7635> - Integer Underflow in {SMD5} Password Comparison #7636 <https://github.com/389ds/389-ds-base/pull/7636> - Issue 7406 <https://github.com/389ds/389-ds-base/issues/7406> - Fix ldap-agent SNMP stats file loading #7630 <https://github.com/389ds/389-ds-base/pull/7630> - Issue 7621 <https://github.com/389ds/389-ds-base/issues/7621> - Stack Buffer Overflow in Password checkPrefix - Issue 7623 <https://github.com/389ds/389-ds-base/issues/7623> - Heap Buffer Overflow in 389-ds-base Audit Log Password Masking - Issue 7602 <https://github.com/389ds/389-ds-base/issues/7602> - CI - lib389 user compare fails due to parentid mismatch #7603 <https://github.com/389ds/389-ds-base/pull/7603> - Issue 7537 <https://github.com/389ds/389-ds-base/issues/7537> - CI - Fix replication log monitoring parser/timing failures #7592 <https://github.com/389ds/389-ds-base/pull/7592> - Issue 7593 <https://github.com/389ds/389-ds-base/issues/7593> - Fix testimony docstring for SASL overflow test #7606 <https://github.com/389ds/389-ds-base/pull/7606> - Issue 7530 <https://github.com/389ds/389-ds-base/issues/7530> - CI - Stabilize DNA plugin replication tests timing out in CI #7572 <https://github.com/389ds/389-ds-base/pull/7572> - Issue 7593 <https://github.com/389ds/389-ds-base/issues/7593> - Reject invalid SASL packet length values in sasl_io_start_packet #7594 <https://github.com/389ds/389-ds-base/pull/7594> - Issue 3555 <https://github.com/389ds/389-ds-base/issues/3555> - UI - Fix audit issue with npm - ws, js-yaml, babel/core #7599 <https://github.com/389ds/389-ds-base/pull/7599> - Bump fast-uri from 3.1.0 to 3.1.2 in /src/cockpit/389-console #7487 <https://github.com/389ds/389-ds-base/pull/7487> - Update dependency uuid to v14 [SECURITY] #7456 <https://github.com/389ds/389-ds-base/pull/7456> - Update cockpit-389-ds-npm (major) #7448 <https://github.com/389ds/389-ds-base/pull/7448> - Issue 7263 <https://github.com/389ds/389-ds-base/issues/7263> - UI - Use cockpit.file API for temporary file writes #7590 <https://github.com/389ds/389-ds-base/pull/7590> - Issue 7541 <https://github.com/389ds/389-ds-base/issues/7541> - Add invalid ACL text header regression test #7591 <https://github.com/389ds/389-ds-base/pull/7591> - Issue 7554 <https://github.com/389ds/389-ds-base/issues/7554> - UI - Revise local password policy layout - Issue 7521 <https://github.com/389ds/389-ds-base/issues/7521> - UI - make changes for cockpit API updates - Issue 7541 <https://github.com/389ds/389-ds-base/issues/7541> - heap-buffer-overflows in __aclp__normalize_acltxt() #7542 <https://github.com/389ds/389-ds-base/pull/7542> - Issue 7531 <https://github.com/389ds/389-ds-base/issues/7531> - Fix LMDB replication regression_m2 failures and core dumps #7575 <https://github.com/389ds/389-ds-base/pull/7575> - Issue 7490 <https://github.com/389ds/389-ds-base/issues/7490> - Enable USDT probes by default in RPM #7491 <https://github.com/389ds/389-ds-base/pull/7491> - Issue 7576 <https://github.com/389ds/389-ds-base/issues/7576> - Fix leak of temporary attribute syntax hash tables after schema reload - Issue 7558 <https://github.com/389ds/389-ds-base/issues/7558> - During online import, the IDL should be created with in-depth first approach #7559 <https://github.com/389ds/389-ds-base/pull/7559> - Issue 7500 <https://github.com/389ds/389-ds-base/issues/7500> - Prevent unsigned integer underflow during stalled import - Issue 7562 <https://github.com/389ds/389-ds-base/issues/7562> - Error: NssSsl.add_cert() got an unexpected keyword argument ‘input_file’ #7563 <https://github.com/389ds/389-ds-base/pull/7563> - Issue 7560 <https://github.com/389ds/389-ds-base/issues/7560> - lib389 - Add helper function for checking ASAN files - Issue 7539 <https://github.com/389ds/389-ds-base/issues/7539> - Server shutdown during online reindex may lead to data loss #7540 <https://github.com/389ds/389-ds-base/pull/7540> - Issue 7549 <https://github.com/389ds/389-ds-base/issues/7549> - Substring index should validate minimum nsSubStrBegin/nsSubStrEnd values #7550 <https://github.com/389ds/389-ds-base/pull/7550> - Issue 7440 <https://github.com/389ds/389-ds-base/issues/7440> - Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured #7441 <https://github.com/389ds/389-ds-base/pull/7441> - Fix test389 imports on older branches - Issue 7267 <https://github.com/389ds/389-ds-base/issues/7267> - MDB_BAD_VALSIZE error when updating index #7268 <https://github.com/389ds/389-ds-base/pull/7268> - Issue 7327 <https://github.com/389ds/389-ds-base/issues/7327> - dsctl healthcheck DSMOLE0001 inaccurate recommendations with multiple backends #7328 <https://github.com/389ds/389-ds-base/pull/7328> - Issue 7372 <https://github.com/389ds/389-ds-base/issues/7372> - Reindex adds tombstones to ancestorid causing export failures #7373 <https://github.com/389ds/389-ds-base/pull/7373> - Issue 7437 <https://github.com/389ds/389-ds-base/issues/7437> - LeakSanitizer: memory leaks in CoS cache error paths #7438 <https://github.com/389ds/389-ds-base/pull/7438> - Issue 3555 <https://github.com/389ds/389-ds-base/issues/3555> - UI - Fix audit issue with npm - brace-expansion #7556 <https://github.com/389ds/389-ds-base/pull/7556> - Issue 7554 <https://github.com/389ds/389-ds-base/issues/7554> - deref plugin null pointer dereference if ber_init fails - Issue 7493 <https://github.com/389ds/389-ds-base/issues/7493> - RFE - Add ShadowAccount fixup task - Issue 7507 <https://github.com/389ds/389-ds-base/issues/7507> - UI - cleanup style and alignments - Issue 7514 <https://github.com/389ds/389-ds-base/issues/7514> - Crash when doing moddn on very large subtree - Issue 7516 <https://github.com/389ds/389-ds-base/issues/7516> - dblayer_bulk_nextdata should not return an error when maxrecords is hit - Issue 7496 <https://github.com/389ds/389-ds-base/issues/7496> - Fix latest GCC compiler warnings - Issue 7503 <https://github.com/389ds/389-ds-base/issues/7503> - CVE -2026-9064 <https://access.redhat.com/security/cve/CVE-2026-9064> - Add a limit to the number controls per operation - Issue 7300 <https://github.com/389ds/389-ds-base/issues/7300> - RFE - Add OS-level thread names to all server threads #7301 <https://github.com/389ds/389-ds-base/pull/7301> - Issue 7460 <https://github.com/389ds/389-ds-base/issues/7460> - MOD_ REPLACE on groups/link attributes modifies overlap targets #7461 <https://github.com/389ds/389-ds-base/pull/7461> - Issue 7307 <https://github.com/389ds/389-ds-base/issues/7307> - RFE - Expose work queue and worker utilization metrics #7308 <https://github.com/389ds/389-ds-base/pull/7308> - Issue 7464 <https://github.com/389ds/389-ds-base/issues/7464> - CLI - allow dsidm to work with other user types - Issue 7457 <https://github.com/389ds/389-ds-base/issues/7457> - Refactor memberOf perf test #7458 <https://github.com/389ds/389-ds-base/pull/7458> - Issue 7431 <https://github.com/389ds/389-ds-base/issues/7431> - password policy - passwordBadWords is ignored in local policies - Issue 7155 <https://github.com/389ds/389-ds-base/issues/7155> - build_candidate_list - Database error 11 with range search #7156 <https://github.com/389ds/389-ds-base/pull/7156> - Issue 7426 <https://github.com/389ds/389-ds-base/issues/7426> - logconv.py is out of sync with server-emitted note codes #7427 <https://github.com/389ds/389-ds-base/pull/7427> - Issue 7417 <https://github.com/389ds/389-ds-base/issues/7417> - UI - global password policy syntax settings missing passwordMaxRepeats - Issue 3555 <https://github.com/389ds/389-ds-base/issues/3555> - UI - Fix audit issue with npm - brace-expansion #7411 <https://github.com/389ds/389-ds-base/pull/7411> - Issue 7088 <https://github.com/389ds/389-ds-base/issues/7088> - Change log level for “Can’t locate CSN” error message - Issue 7423 <https://github.com/389ds/389-ds-base/issues/7423> - cleanup pblock after freeing pre/post entries - Issue 7418 <https://github.com/389ds/389-ds-base/issues/7418> - Use-after-free in deferred memberof #7419 <https://github.com/389ds/389-ds-base/pull/7419> - Issue 7407 <https://github.com/389ds/389-ds-base/issues/7407> - dbscan -k option display entries that do not match the specified key - Issue 7404 <https://github.com/389ds/389-ds-base/issues/7404> - fix latest compiler warnings(cherry-pick issue) - Issue 7404 <https://github.com/389ds/389-ds-base/issues/7404> - fix latest compiler warnings - Issue 7394 <https://github.com/389ds/389-ds-base/issues/7394> - UI - Manual typing of ports can leave out digits #7395 <https://github.com/389ds/389-ds-base/pull/7395> - Issue 7277 <https://github.com/389ds/389-ds-base/issues/7277> - UI - Fix Japanese translation errors errors in Cockpit UI #7386 <https://github.com/389ds/389-ds-base/pull/7386> - Issue 7246 <https://github.com/389ds/389-ds-base/issues/7246> - correct formatting of ‘Gen as CSN’ in dsctl get-nsstate output #7247 <https://github.com/389ds/389-ds-base/pull/7247> - Issue 7126 <https://github.com/389ds/389-ds-base/issues/7126> - WARN - keys2idl - received NULL idl from index_read_ext_allids #7127 <https://github.com/389ds/389-ds-base/pull/7127> - Issue 7370 <https://github.com/389ds/389-ds-base/issues/7370> - Runtime LSan/TSan injection for pytest #7371 <https://github.com/389ds/389-ds-base/pull/7371> - Issue 7378 <https://github.com/389ds/389-ds-base/issues/7378> - Make sure suffix entry always gets assigned ID 1 - Issue 7380 <https://github.com/389ds/389-ds-base/issues/7380> - Internal op with negative wtime and large optime #7381 <https://github.com/389ds/389-ds-base/pull/7381> - Issue 7362 <https://github.com/389ds/389-ds-base/issues/7362> - UI - Some FormSelect onChange parameters are reversed - Issue 7368 <https://github.com/389ds/389-ds-base/issues/7368> - UI - global password policy page is missing passwordmintokenlength - Issue 7366 <https://github.com/389ds/389-ds-base/issues/7366> - Memory leaks in syncrepl plugin during persistent search operations #7367 <https://github.com/389ds/389-ds-base/pull/7367> - Issue 3658 <https://github.com/389ds/389-ds-base/issues/3658> - UI/CLI - show progress of db tasks - Issue 7284 <https://github.com/389ds/389-ds-base/issues/7284> - CI - Fix test_grace_limit_section after pwpolicy validation fix #7357 <https://github.com/389ds/389-ds-base/pull/7357> - Issue 7271 <https://github.com/389ds/389-ds-base/issues/7271> - Add test for retrocl trimming shutdown crash #7356 <https://github.com/389ds/389-ds-base/pull/7356> - Issue 3555 <https://github.com/389ds/389-ds-base/issues/3555> - UI - Fix audit issue with npm - flatted, picomatch #7364 <https://github.com/389ds/389-ds-base/pull/7364> - Issue 7337 <https://github.com/389ds/389-ds-base/issues/7337> - UI - refactor all error handling to use getApiErrorMessge - Issue 1704 <https://github.com/389ds/389-ds-base/issues/1704> - DNA plugin creates invalid shared config entry with port 0 #7352 <https://github.com/389ds/389-ds-base/pull/7352> - Issue 7348 <https://github.com/389ds/389-ds-base/issues/7348> - CI - Fix failing dsconf security CLI add cert test #7349 <https://github.com/389ds/389-ds-base/pull/7349> - Issue 7346 <https://github.com/389ds/389-ds-base/issues/7346> - DS does not handle escape char in bind user #7347 <https://github.com/389ds/389-ds-base/pull/7347> - Issue 7322 <https://github.com/389ds/389-ds-base/issues/7322> - Reject adding a replication agreement that points to itself - Issue 7312 <https://github.com/389ds/389-ds-base/issues/7312> - UI - Database Maximum Size cannot be easily set by typing #7313 <https://github.com/389ds/389-ds-base/pull/7313> - Issue 7342 <https://github.com/389ds/389-ds-base/issues/7342> - CI - repl config regression #7343 <https://github.com/389ds/389-ds-base/pull/7343> - Issue 7339 <https://github.com/389ds/389-ds-base/issues/7339> - Return the exact DN during export - Issue - UI - Improve suffix import LDIF table - Issue 7325 <https://github.com/389ds/389-ds-base/issues/7325> - UI - new error parser missing import - Issue 7325 <https://github.com/389ds/389-ds-base/issues/7325> - UI - create an error parser for cockpit spawn errors - Issue 7319 <https://github.com/389ds/389-ds-base/issues/7319> - Action menu for certificates remains in empty certificate list #7320 <https://github.com/389ds/389-ds-base/pull/7320> - Issue 7265 <https://github.com/389ds/389-ds-base/issues/7265> - CI - fix retro changelog maxage validation test - Issue 7093 <https://github.com/389ds/389-ds-base/issues/7093> - A password policy can be created even when an identical policy already exists #7283 <https://github.com/389ds/389-ds-base/pull/7283> - Issue 7316 <https://github.com/389ds/389-ds-base/issues/7316> - UI - update npm module immutable - Issue 7233 <https://github.com/389ds/389-ds-base/issues/7233> - test_produce_division_by_zero fails with IsADirectoryError in conftest.py #7234 <https://github.com/389ds/389-ds-base/pull/7234> - Issue 7314 <https://github.com/389ds/389-ds-base/issues/7314> - UI - Add progress steppers to Security, Database, and Replication tabs - Issuei 7281 - UI - Add encryption module management - Issue 7271 <https://github.com/389ds/389-ds-base/issues/7271> - Add new plugin pre-close function check to plugin_invoke_plugin_pb - Issue 7304 <https://github.com/389ds/389-ds-base/issues/7304> - retrocl should not cache DN - Issue 7265 <https://github.com/389ds/389-ds-base/issues/7265> - Add dse modify callback to validate retrocl trimming settings - Issue 7152 <https://github.com/389ds/389-ds-base/issues/7152> - ns-slapd fails to shutdown when deferred memberof update is in progress #7187 <https://github.com/389ds/389-ds-base/pull/7187> - Issue 3555 <https://github.com/389ds/389-ds-base/issues/3555> - UI - Fix audit issue with npm - ajv, minimatch #7298 <https://github.com/389ds/389-ds-base/pull/7298> - Issue 7291 <https://github.com/389ds/389-ds-base/issues/7291> - Crash when configuring a replica with an incorrect nsds5ReplicaRoot #7292 <https://github.com/389ds/389-ds-base/pull/7292> - Issue 7271 <https://github.com/389ds/389-ds-base/issues/7271> - implement a pre-close plugin function - Issue 7281 <https://github.com/389ds/389-ds-base/issues/7281> - RFE - CLI - add support to managing additional encryption modules - Issue 7265 <https://github.com/389ds/389-ds-base/issues/7265> - changelog maxage validation is not strict enough - Issue 7284 <https://github.com/389ds/389-ds-base/issues/7284> - Creating local password policy succeeds with incorrect passwordInHistory value #7285 <https://github.com/389ds/389-ds-base/pull/7285> - Security fix for CVE-2025-14905 <https://access.redhat.com/security/cve/CVE-2025-14905> - Issue 7277 <https://github.com/389ds/389-ds-base/issues/7277> - UI - Fix Japanese translation for “Successfully updated group” in Cockpit UI #7278 <https://github.com/389ds/389-ds-base/pull/7278> - Issue 7275 <https://github.com/389ds/389-ds-base/issues/7275> - UI - Improve password policy field validation in Cockpit UI #7276 <https://github.com/389ds/389-ds-base/pull/7276> - Issue 7279 <https://github.com/389ds/389-ds-base/issues/7279> - UI - Fix typo in export certificate dialog #7280 <https://github.com/389ds/389-ds-base/pull/7280> - Issue 7273 <https://github.com/389ds/389-ds-base/issues/7273> - In a chaining environment binding as remote user causes an invalid error in the logs - Issue 7271 <https://github.com/389ds/389-ds-base/issues/7271> - plugins that create threads need to update - Issue 5853 <https://github.com/389ds/389-ds-base/issues/5853> - Update concread to 0.5.10 - Issue 7223 <https://github.com/389ds/389-ds-base/issues/7223> - Remove integerOrderingMatch requirement for parentid #7264 <https://github.com/389ds/389-ds-base/pull/7264> - Issue 7243 <https://github.com/389ds/389-ds-base/issues/7243> - UI - fix certificate table and modal - Issue 7066 <https://github.com/389ds/389-ds-base/issues/7066>/7052 - allow password history to be set to zero and remove history - Issue 7223 <https://github.com/389ds/389-ds-base/issues/7223> - Use lexicographical order for ancestorid #7256 <https://github.com/389ds/389-ds-base/pull/7256> - Issue 7213 <https://github.com/389ds/389-ds-base/issues/7213> - (2nd) MDB_BAD_VALSIZE error while handling VLV #7258 <https://github.com/389ds/389-ds-base/pull/7258> - Issue 7184 <https://github.com/389ds/389-ds-base/issues/7184> - (2nd) argparse.HelpFormatter _format_actions_usage() is deprecated #7257 <https://github.com/389ds/389-ds-base/pull/7257> - Issue - CLI - dsctl db2index needs some hardening with MBD - Issue 7248 <https://github.com/389ds/389-ds-base/issues/7248> - CLI - attribute uniqueness - fix usage for exclude subtree option - Issue 7231 <https://github.com/389ds/389-ds-base/issues/7231> - Sync repl tests fail in FIPS mode due to non FIPS compliant crypto #7232 <https://github.com/389ds/389-ds-base/pull/7232> - Issue 7121 <https://github.com/389ds/389-ds-base/issues/7121> - (2nd) LeakSanitizer: various leaks during replication #7212 <https://github.com/389ds/389-ds-base/pull/7212> - Issue 6947 <https://github.com/389ds/389-ds-base/issues/6947> - Fix health_system_indexes_test.py - Issue 7221 <https://github.com/389ds/389-ds-base/issues/7221> - CI tests - fix some flaky tests - Issue 7076 <https://github.com/389ds/389-ds-base/issues/7076> - Fix revert_cache() never called in modrdn #7220 <https://github.com/389ds/389-ds-base/pull/7220> - Issue 7096 <https://github.com/389ds/389-ds-base/issues/7096> - (2nd) During replication online total init the function idl_id_is_in_idlist is not scaling with large database #7205 <https://github.com/389ds/389-ds-base/pull/7205> - Issue 3555 <https://github.com/389ds/389-ds-base/issues/3555> - UI - Fix audit issue with npm - @isaacs/brace-expansion #7228 <https://github.com/389ds/389-ds-base/pull/7228> - Issue 7223 <https://github.com/389ds/389-ds-base/issues/7223> - Add dsctl index-check command for offline index repair - Issue 7223 <https://github.com/389ds/389-ds-base/issues/7223> - Detect and log index ordering mismatch during backend startup - Issue 7223 <https://github.com/389ds/389-ds-base/issues/7223> - Add upgrade function to remove ancestorid index config entry - Issue 7223 <https://github.com/389ds/389-ds-base/issues/7223> - Add upgrade function to remove nsIndexIDListScanLimit from parentid - Issue 7223 <https://github.com/389ds/389-ds-base/issues/7223> - Revert index scan limits for system indexes - Issue 7224 <https://github.com/389ds/389-ds-base/issues/7224> - CI Test - Simplify test_reserve_descriptor_validation #7225 <https://github.com/389ds/389-ds-base/pull/7225> - Issue 7194 <https://github.com/389ds/389-ds-base/issues/7194> - Repl Log Analysis - Add CSN propagation details #7195 <https://github.com/389ds/389-ds-base/pull/7195> - Issue 7213 <https://github.com/389ds/389-ds-base/issues/7213> - MDB_BAD_VALSIZE error while handling VLV #7214 <https://github.com/389ds/389-ds-base/pull/7214> - Issue 7027 <https://github.com/389ds/389-ds-base/issues/7027> - (2nd) 389-ds-base OpenScanHub Leaks Detected #7211 <https://github.com/389ds/389-ds-base/pull/7211> - Issue 7184 <https://github.com/389ds/389-ds-base/issues/7184> - argparse.HelpFormatter _format_actions_usage() is deprecated - Issue 7198 <https://github.com/389ds/389-ds-base/issues/7198> - Web console doesn’t show sub-suffix when parent-suffix points to an entry #7202 <https://github.com/389ds/389-ds-base/pull/7202> - Issue 7189 <https://github.com/389ds/389-ds-base/issues/7189> - DSBLE0007 generates incorrect remediation commands for scan limits - Bump lodash from 4.17.21 to 4.17.23 in /src/cockpit/389-console #7203 <https://github.com/389ds/389-ds-base/pull/7203> - Issue 7172 <https://github.com/389ds/389-ds-base/issues/7172> - (2nd) Index ordering mismatch after upgrade #7180 <https://github.com/389ds/389-ds-base/pull/7180> - Issue 7172 <https://github.com/389ds/389-ds-base/issues/7172> - Index ordering mismatch after upgrade #7173 <https://github.com/389ds/389-ds-base/pull/7173> - Issue 7108 <https://github.com/389ds/389-ds-base/issues/7108> - Fix shutdown crash in entry cache destruction #7163 <https://github.com/389ds/389-ds-base/pull/7163> - Issue - Revise paged result search locking - Issue 7096 <https://github.com/389ds/389-ds-base/issues/7096> - During replication online total init the function idl_id_is_in_idlist is not scaling with large database #7145 <https://github.com/389ds/389-ds-base/pull/7145> - Issue 7160 <https://github.com/389ds/389-ds-base/issues/7160> - Add lib389 version sync check to configure #7165 <https://github.com/389ds/389-ds-base/pull/7165> - Issue 7166 <https://github.com/389ds/389-ds-base/issues/7166> - db_config_set asserts because of dynamic list #7167 <https://github.com/389ds/389-ds-base/pull/7167> - Sync lib389 version to 3.1.4 #7161 <https://github.com/389ds/389-ds-base/pull/7161> - Issue 7150 <https://github.com/389ds/389-ds-base/issues/7150> - Compressed access log rotations skipped, accesslog-list out of sync #7151 <https://github.com/389ds/389-ds-base/pull/7151>

1 0