{"id":"SUSE-SU-2026:1753-1","summary":"Security update for 389-ds","details":"This update for 389-ds fixes the following issues:\n\nUpdate to version 2.0.20~git89.937b1f291.\n\nSecurity issues fixed:\n\n- CVE-2025-14905: heap buffer overflow due to improper size calculation in `schema_attr_enum_callback` callback\n  (bsc#1258727).\n\nOther updates and bugfixes:\n\n- Issue 7224 - CI Test - Simplify `test_reserve_descriptor_validation` (#7225).\n- Issue 7189 - DSBLE0007 generates incorrect remediation commands for scan limits.\n- Issue 7172 - (2nd) Index ordering mismatch after upgrade (#7180).\n- Issue 7172 - Index ordering mismatch after upgrade (#7173).\n- Issue 7096 - During replication online total init the function idl_id_is_in_idlist is not scaling with large database\n  (#7145).\n- Issue 7091 - Duplicate local password policy entries listed (#7092).\n- Issue 7124 - BDB cursor race condition with transaction isolation (#7125).\n- Issue 7121 - LeakSanitizer: various leaks during replication (#7122).\n- Issue 7115 - LeakSanitizer: leak in `slapd_bind_local_user()` (#7116).\n- Issue 7109 - AddressSanitizer: SEGV `ldap/servers/slapd/csnset.c:302` in `csnset_dup` (#7114).\n- Issue 7056 - DSBLE0007 doesn't generate remediation steps for missing indexes.\n- Issue 6846 - Attribute uniqueness is not enforced with modrdn (#7026).\n- Issue 7055 - Online initialization of consumers fails with error `-23` (#7075).\n- Issue 7065 - A search filter containing a non normalized DN assertion does not return matching entries (#7068).\n- Issue 7032 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue (#7036).\n- Issue 6966 - On large DB, unlimited IDL scan limit reduce the SRCH performance (#6967).\n- Issue 6848 - AddressSanitizer: leak in `do_search`.\n- Issue 6928 - The `parentId` attribute is indexed with improper matching rule.\n- Issue 6933 - When deferred `memberof` update is enabled after the server crashed it should not launch memberof fixup\n  task by default (#6935).\n- Issue 6929 - Compilation failure with `rust-1.89` on Fedora ELN.\n- Issue 6859 - `str2filter` is not fully applying matching rules.\n- Issue 6857 - `uiduniq`: allow specifying match rules in the filter.\n- Issue 6893 - Log user that is updated during password modify extended operation.\n- Issue 6680 - instance read-only mode is broken (#6681).\n","modified":"2026-05-08T08:15:51.377096Z","published":"2026-05-07T13:54:14Z","related":["CVE-2025-14905"],"upstream":["CVE-2025-14905"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261753-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1258727"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-14905"}],"schema_version":"1.7.5"}