Bug 2529451

Summary: CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search [fedora-all]
Product: [Fedora] Fedora Reporter: Samuele Negrini <snegrini>
Component: 389-ds-baseAssignee: Viktor Ashirov <vashirov>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: abokovoy, jachapma, mreynolds, spichugi, tbordaz, vashirov
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---Flags: fedora-admin-xmlrpc: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["3d3c74e7-386c-4907-8e46-90d880722012"]}
Fixed In Version: 389-ds-base-3.3.1-3.fc45 389-ds-base-3.1.5-4.fc43 389-ds-base-3.2.3-5.fc44 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-09-25 00:17:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2509696    

Description Samuele Negrini 2026-09-07 13:16:23 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in 389 Directory Server. The op_shared_search function in opshared.c does not check for a NULL backend pointer when reusing a paged-results slot in the be_name (USE_ONE_BACKEND control) code path. An unauthenticated client can exploit this by sending two SEARCH requests on the same connection: the first names a non-existent backend via the USE_ONE_BACKEND control with a Simple Paged Results (SPR) empty cookie, storing NULL as the backend in a paged-results slot; the second names a valid backend with an SPR cookie referencing that slot, causing the server to retrieve the stored NULL and call slapi_be_Rlock(NULL), which dereferences the NULL pointer and crashes the ns-slapd process. This is reachable pre-authentication because control and paged-results processing runs before search authorization. Paged results and anonymous access are both enabled by default.

Comment 1 Viktor Ashirov 2026-09-07 18:38:55 UTC
Fixed in https://github.com/389ds/389-ds-base/commit/d07646ac1

Comment 2 Fedora Update System 2026-09-07 21:24:38 UTC
FEDORA-2026-b16c9cbc0f (389-ds-base-3.2.3-2.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-b16c9cbc0f

Comment 3 Fedora Update System 2026-09-08 01:38:43 UTC
FEDORA-2026-c1e25a4642 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-c1e25a4642`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-c1e25a4642

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2026-09-08 01:58:36 UTC
FEDORA-2026-b16c9cbc0f has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-b16c9cbc0f`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-b16c9cbc0f

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-09-08 02:21:01 UTC
FEDORA-2026-0b8bc362b1 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-0b8bc362b1`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-0b8bc362b1

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2026-09-09 05:04:37 UTC
FEDORA-2026-b16c9cbc0f has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-b16c9cbc0f`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-b16c9cbc0f

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2026-09-10 01:46:45 UTC
FEDORA-2026-b16c9cbc0f has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-b16c9cbc0f`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-b16c9cbc0f

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2026-09-10 02:07:06 UTC
FEDORA-2026-0b8bc362b1 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-0b8bc362b1`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-0b8bc362b1

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2026-09-10 02:16:50 UTC
FEDORA-2026-c1e25a4642 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-c1e25a4642`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-c1e25a4642

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 10 Fedora Update System 2026-09-25 00:17:04 UTC
FEDORA-2026-c1e25a4642 (389-ds-base-3.3.1-3.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 11 Fedora Update System 2026-09-25 00:55:41 UTC
FEDORA-2026-0b8bc362b1 (389-ds-base-3.1.5-4.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 12 Fedora Update System 2026-09-25 01:12:41 UTC
FEDORA-2026-b16c9cbc0f (389-ds-base-3.2.3-5.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.