Thursday, September 10, 2026

[389-users] Announcing 389 Directory Server 3.2.3 (F44)

389 Directory Server 3.2.3

The 389 Directory Server team is proud to announce 389-ds-base version 3.2.3.

Source tarball:

Fedora 44 update: https://bodhi.fedoraproject.org/updates/FEDORA-2026-b16c9cbc0f

Highlights in 3.2.3

  • Security fixes for CVE-2026-11770, CVE-2026-18355, CVE-2026-18453, CVE-2026-18922, CVE-2026-19843, CVE-2026-76560.
  • Add sysusers.d support, modern systemd path detection, and dynamic-certificate request validation.
  • Add Have I Been Pwned password breach validation and offline thread-pool saturation diagnostics.
  • Prevent silent entry loss during LMDB bulk import and improve replication total initialization on high-latency storage.
  • Strengthen PBKDF2 validation, deferred MemberOf updates, range searches, and online reindex safety.

See Download for package installation and Install Guide for setup.

Changelog between 389-ds-base-3.2.2 and 389-ds-base-3.2.3:

  • Bump version to 3.2.3
  • Security fix for CVE-2026-76560
  • Security fix for CVE-2026-19843
  • Security fix for CVE-2026-18922
  • Security fix for CVE-2026-18453
  • Security fix for CVE-2026-18355
  • Issue 7808 - CI - harden online_import_nosync_test #7809
  • Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs
  • Migrate pwdchan to base64 0.23 Engine API
  • Update rust-dependencies
  • Issue 7611 - PBKDF2 password verification should reject invalid iteration counts #7632
  • Issue 6176 - Add sysusers.d support and modernize systemd path detection #7776
  • Reject mismatched cn in dynamic certificate add requests #7680
  • Fix expiration time check #7718
  • Issue 7774 - Add backport action #7775
  • Issue 7770 - Testimony failure in test_cleanruv_extop_security.py #7771
  • CVE-2026-11770 - Fix StartReplicationRequest auth gate response format
  • Security fix for CVE-2026-11770
  • Issue 7595 - Skip redundant CI runs to relieve the Actions queue #7747
  • Issue 7760 - CI - harden dsconf_task_test.py
  • Issue 4701 - Fix UAF when excluding attrs from retro changelog #7730
  • Issue 7723 - Range search returns an empty result when its start key is removed #7724
  • Issue 7639 - Move log compression outside of global write lock
  • Issue 7631 - Don’t install bpftrace by default #7726
  • Issue 7735 - Heap overflow when parsing objectclass superior #7736
  • Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict #7734
  • Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer #7708
  • Issue 7688 - BUG - partial address leak in sso token #7689
  • Issue 7705 - With memberOfEntryScope set, deferred memberOf skips MODIFY operations #7706
  • Issue 7698 - Fix silent entry loss in LMDB bulk import waiter handling #7699
  • Issue 7711 - Fix typo in accountpolicy –login-history-size help text #7713
  • Issue 6419 - Error: name ‘cockpit_present’ is not defined #7719
  • Issue 7666 - Replication performance degradation during total init on high-latency storage #7667
  • Issue 7645 - Add runtime LeakSanitizer leak check #7646
  • Issue 7709 - Add EPEL 10 target to Packit COPR builds
  • Issue 7714 - UI - sass import rules are deprecated
  • Issue 7658 - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND
  • Issue 7710 - MemberOf deferred update - Use condvar instead of sleep loop
  • Issue 7637 - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload
  • Issue 7578 - schema - attribute refcount is not maintained properly
  • Issue 7468 - RFE - HIBP password breach validation #7492
  • Issue 7605 - Harden CI test ports against ephemeral allocation #7692
  • Issue 7528 - Retry the CI image pull instead of failing the job #7691
  • Backport Issue 7519 — ignore obsolete entrydn when entryrdn is in use #7657
  • Issue 7466 - UI - Refactor all TextInput number types to NumberInput
  • Issue 7505 - RFE - CLI - add feature to determine which password policy applies to a user
  • Issue 7670 - BDB range searches intermittently fail with err=1 under write load #7671
  • Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value #7662
  • Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value #7608
  • Issue 7200 - repl-agmt create doesn’t set some parameters #7663
  • Issue 7573 - Post-import cache autotuning does not recompute entry cache size #7574
  • Issue 7611 - Preserve legacy PBKDF2 hash compatibility #7649
  • Issue 7547 - Heap buffer overflow in ldap_utf8prev()
  • Issue 7611 - PBKDF2 password verification should reject invalid iteration count #7613
  • Issue 7535 - Fix race in test_schema_update_policy_reject
  • Issue 7558 - Total init sends the suffix entry twice #7640
  • Issue 7635 - Integer Underflow in {SMD5} Password Comparison #7636
  • Issue 7406 - Fix ldap-agent SNMP stats file loading #7630
  • Issue 7621 - Stack Buffer Overflow in Password checkPrefix
  • Issue 7623 - Heap Buffer Overflow in 389-ds-base Audit Log Password Masking
  • Issue 7602 - CI - lib389 user compare fails due to parentid mismatch #7603
  • Issue 3555 - UI - Fix audit issue with npm - ws, js-yaml, babel/core #7599
  • Issue 7263 - UI - Use cockpit.file API for temporary file writes #7590
  • Issue 7541 - Add invalid ACL text header regression test #7591
  • Issue 7554 - UI - Revise local password policy layout
  • Issue 7521 - UI - make changes for cockpit API updates
  • Issue 7541 - heap-buffer-overflows in __aclp__normalize_acltxt() #7542
  • Issue 7490 - Enable USDT probes by default in RPM #7491
  • Issue 7576 - Fix leak of temporary attribute syntax hash tables after schema reload
  • Issue 7549 - Substring index should validate minimum nsSubStrBegin/nsSubStrEnd values #7550
  • Issue 7539 - Server shutdown during online reindex may lead to data loss #7540
  • Issue 7558 - During online import, the IDL should be created with in-depth first approach #7559
  • Issue 7500 - Prevent unsigned integer underflow during stalled import
  • Issue 7562 - Error: NssSsl.add_cert() got an unexpected keyword argument ‘input_file’ #7563
  • Issue 7560 - lib389 - Add helper function for checking ASAN files
  • Issue 3555 - UI - Fix audit issue with npm - brace-expansion #7556
  • Issue 7554 - deref plugin null pointer dereference if ber_init fails

-- _______________________________________________ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new

Posted by at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)