SUSE SLES15 Security Update : 389-ds (SUSE-SU-2026:4929-1)

critical Nessus Plugin ID 374164

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4929-1 advisory.

- CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).
- CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remote code execution (bsc#1279864).
- CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (bsc#1279572).
- CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865).
- CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated privileges to execute shell commands with root privileges on the directory server host (bsc#1279866).
- CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client to bypass access controls on directory entries containing empty SELFDN attributes (bsc#1279867).
- CVE-2026-86344: incomplete LDAP messages sent in rapid succession can cause worker thread exhaustion (bsc#1284028).
- CVE-2026-86345: smuggled plaintext commands sent alongside StartTLS requests can cause response forgery and authentication bypasses (bsc#1284034).

Update to version 2.2.11~git12.1e612cde2:

* Issue 7919 - CVE-2026-86344 - Fix worker pool exhaustion via partial LDAP messages (DoS)
* Issue 7921 - Fix StartTLS plaintext buffer handling (#7922) (#7947)

Update to version 2.2.11~git10.1f26fcebd:

* Issue 7912 - dsidm role create-filtered ignores --nsrolefilter and forces an interactive prompt (#7913)
* Issue 7908 - dsctl cockpit open-firewall --zone passes a malformed argument (#7909)
* Issue 7848 - Reject incomplete MD5 and GOST-YESCRYPT hashes (#7849)
* Issue 7837 - importing ldif with entry with long attribute name and subtype causes stack-buffer- overflow (#7838)
* Issue 6270 - heap-use-after-free with pwp dictionary path (#7791)
* Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7632) (#7854)
* iadvisories/GHSA-rgxx-hcc4-x3h4 / heap-buffer-overflow in rdn_av_swap (#7826)
* Migrate pwdchan to base64 0.23 Engine API
* Update rust-dependencies

Update to version 2.2.11~git1.98ee3aac7:

* Issue 7757 - stack-buffer-overflow caused by slapi_attr_init_syntax() (#7759)
* Bump version to 2.2.11
* Security fix for CVE-2026-76560
* Security fix for CVE-2026-19843
* Security fix for CVE-2026-18922
* Security fix for CVE-2026-18453
* Security fix for CVE-2026-18355
* Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs
* Fix expiration time check (#7718)
* Issue 7774 - Add backport action (#7775)
* Issue 7770 - Testimony failure in test_cleanruv_extop_security.py (#7771)
* Issue 1704 - Include stdbool.h in slapi headers on 2.4 (#7768)
* CVE-2026-11770 - Fix StartReplicationRequest auth gate response format
* Security fix for CVE-2026-11770
* Issue 3082 - Add test389.topologies compatibility shim for backports (#7725)
* Issue 7595 - Skip redundant CI runs to relieve the Actions queue (#7755)
* Issue 4701 - Fix UAF when excluding attrs from retro changelog (#7730)
* Issue 7723 - Range search returns an empty result when its start key is removed (#7724)
* Issue 7735 - Heap overflow when parsing objectclass superior (#7736)
* Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict (#7734)
* Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in join_supplier/hub/consumer (#7708)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected 389-ds, 389-ds-devel, lib389 and / or libsvrcore0 packages.

Plugin Details

Severity: Critical

ID: 374164

File Name: suse_SU-2026-4929-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 10/30/2026

Updated: 10/30/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.6

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-18922

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:389-ds-devel, p-cpe:/a:novell:suse_linux:389-ds, p-cpe:/a:novell:suse_linux:lib389, p-cpe:/a:novell:suse_linux:libsvrcore0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/29/2026

Vulnerability Publication Date: 7/2/2026

Reference Information

CVE: CVE-2026-11770, CVE-2026-18355, CVE-2026-18453, CVE-2026-18922, CVE-2026-19843, CVE-2026-76560, CVE-2026-86344, CVE-2026-86345

SuSE: SUSE-SU-2026:4929-1

Detections

Analytics