RHSA-2026:65119HighCVSS 7.5

Red Hat Security Advisory: Red Hat Directory Server 13.2 container image update

Published
September 8, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (4)

CVE-2026-18355 →CVE-2026-18453 →CVE-2026-76560 →CVE-2026-78701 →

📋 Description

CVE-2026-18355 — 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() CVE-2026-18453 — 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search CVE-2026-76560 — 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN CVE-2026-78701 — 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS

🎯 Affected products2

  • Red Hat Directory Server 13.2
  • registry.redhat.io/dirsrv/dirsrv-container-rhel10@sha256:d69a0f6a61eb3bd773e4b49be6b6093dd413e7a3a24b30df31d804031f3b5889_amd64 as a component of Red Hat Directory Server 13.2

✅ Remediation

The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. For more information about the image, search the <image_name> in the Red Hat Ecosystem Catalog: https://catalog.redhat.com/software/containers/search Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Until a fix is available, review all ACIs using userattr="...#SELFDN" bind rules and confirm the target attribute cannot be set to an empty value, or add an explicit authmethod restriction to the ACI to prevent anonymous binds from satisfying the check. Where anonymous binds are not required, disabling anonymous access to the directory removes the attack surface entirely. Workaround: To mitigate this issue, restrict network access to the 389-ds-base service to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the LDAP ports (typically 389 for LDAP and 636 for LDAPS) to known, authorized IP addresses or subnets. Example using `firewalld`: ```bash # firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_SUBNET>" port port="389" protocol="tcp" accept' # firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_SUBNET>" port port="636" protocol="tcp" accept' # firewall-cmd --reload ``` Replace `<TRUSTED_IP_OR_SUBNET>` with the actual IP addresses or network ranges of your trusted clients. This action may impact legitimate clients if not configured correctly. A service restart is not required for firewall changes to take effect.

🔗 References (9)