Debian Patches

Status for 389-ds-base/3.1.2+vendor1-2

Patch Description Author Forwarded Bugs Origin Last update
fix-saslpath.diff no
0001-Security-fix-for-CVE-2025-2487.patch Security fix for CVE-2025-2487
Description:
A denial of service vulnerability was found in the 389 Directory Server.
The 389 Directory Server may crash (Null Pointer Exception) after some
failed rename subtree operations (i.e. MODDN) issued by a user having enough
privileges to do so.

References:
- https://access.redhat.com/security/cve/CVE-2025-2487
- https://bugzilla.redhat.com/show_bug.cgi?id=2353071
Pierre Rogier <progier@redhat.com> no 2025-02-27
dont-lock-cargo.diff diff --git a/Makefile.am b/Makefile.am
index dfaaa47dc..aad97b63f 100644
no
fix-build-fail-with-gcc15.diff commit 5249788ee51c1b630994f2516c809151f79ea036

Issue 6476 - Fix build failure with GCC 15

Description:

Most of the failures are our use of function pointer with a generic
typedef with unknown parameters (e.g. IFP)

There are other IFP we use, but they are not triggering build failures
yet.

Relates: https://github.com/389ds/389-ds-base/issues/6476

Reviewed by: tbordaz & spichugi (Thanks!!)

diff --git a/dirsrvtests/tests/suites/replication/acceptance_test.py b/dirsrvtests/tests/suites/replication/acceptance_test.py
index c2f3f2572..83b312a42 100644
Mark Reynolds <mreynolds@redhat.com> no 2025-01-28
fix-build-with-newer-rust.diff commit 1701419551c246e9dc21778b118220eeb2258125

Issue 6929 - Compilation failure with rust-1.89 on Fedora ELN

Bug Description:
The `ValueArrayRefIter` struct has a lifetime parameter `'a`.
But in the `iter` method the return type doesn't specify the lifetime parameter.

Fix Description:
Make the lifetime explicit.

Fixes: https://github.com/389ds/389-ds-base/issues/6929

Reviewed by: @droideck (Thanks!)

diff --git a/src/slapi_r_plugin/src/value.rs b/src/slapi_r_plugin/src/value.rs
index 2fd35c808..fec74ac25 100644
Viktor Ashirov <vashirov@redhat.com> no 2025-08-11
0001-Issue-7184-argparse.HelpFormatter-_format_actions_us.patch Issue 7184 - argparse.HelpFormatter _format_actions_usage() is deprecated

Description:

_format_actions_usage() was removed in python 3.15. Instead we can use
_get_actions_usage_parts() but it also behaves differently between
python 3.14 and 3.15 so we need special handling.


Reviewed by: spichugi(Thanks!)
Mark Reynolds <mreynolds@redhat.com> no 2026-01-12
0001-Issue-7184-2nd-argparse.HelpFormatter-_format_action.patch Issue 7184 - (2nd) argparse.HelpFormatter _format_actions_usage() is deprecated (#7257)

Description:
`_format_actions_usage()` was also removed in Python 3.14.3.
Replace version check with `isinstance()` to handle the return type of
`_get_actions_usage_parts()` more robustly across Python versions.


Reviewed by: @progier389 (Thanks!)
Viktor Ashirov <vashirov@redhat.com> no 2026-02-13
0001-Security-fix-for-CVE-2025-14905.patch Security fix for CVE-2025-14905
Description:
A vulnerability was found in the 389 Directory Server.
The 389 Directory Server present a risk of heap buffer overflow that
can be exploited to excute a Denial of Service and potential Remote
Code Execution

References:
- https://access.redhat.com/security/cve/CVE-2025-14905
- https://bugzilla.redhat.com/show_bug.cgi?id=2423624
tbordaz <tbordaz@redhat.com> no 2026-02-25

All known versions for source package '389-ds-base'

Links