Fedora 43 : 389-ds-base (2026-0b8bc362b1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-0b8bc362b1
#

include('compat.inc');

if (description)
{
  script_id(349931);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/24");

  script_cve_id(
    "CVE-2026-11610",
    "CVE-2026-11611",
    "CVE-2026-11770",
    "CVE-2026-11774",
    "CVE-2026-11789",
    "CVE-2026-11790",
    "CVE-2026-11792",
    "CVE-2026-11793",
    "CVE-2026-11884",
    "CVE-2026-15041",
    "CVE-2026-18355",
    "CVE-2026-18453",
    "CVE-2026-19404",
    "CVE-2026-69152",
    "CVE-2026-76560"
  );
  script_xref(name:"FEDORA", value:"2026-0b8bc362b1");

  script_name(english:"Fedora 43 : 389-ds-base (2026-0b8bc362b1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the
FEDORA-2026-0b8bc362b1 advisory.

    - Resolves: rhbz#2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length
    bypasses size limit leading to heap buffer overflow [fedora-all]
    - Resolves: rhbz#2497652 CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv()
    via padded SASL UNBIND [fedora-all]
    - Resolves: rhbz#2511796 CVE-2026-69152 389-ds-base: brace-expansion: Denial of Service via unbounded
    intermediate arrays [fedora-all]
    - Resolves: rhbz#2529450 CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI
    bind-rule checks via empty bind DN [fedora-all]
    - Resolves: rhbz#2529451 CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer
    dereference via paged results and USE_ONE_BACKEND control in op_shared_search [fedora-all]
    - Resolves: rhbz#2529452 CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-
    record length lower-bound underflow in sasl_io_start_packet() [fedora-all]
    - Resolves: rhbz#2494775 CVE-2026-11611 389-ds-base: 389-ds-base: Content Sync plugin unbounded queue
    growth and race conditions [fedora-all]
    - Resolves: rhbz#2494825 CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema
    objectclass serialization due to missing oc_superior in size calculation [fedora-all]
    - Resolves: rhbz#2494894 CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded
    iteration count denial of service [fedora-all]
    - Resolves: rhbz#2494895 CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length
    integer underflow crash [fedora-all]
    - Resolves: rhbz#2509729 CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in
    CleanAllRUV status check [fedora-all]
    - Resolves: rhbz#2513063 CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous
    clients to start or abort CleanAllRUV replication maintenance [fedora-all]
    - Resolves: rhbz#2494827 CVE-2026-11793 389-ds-base: 389-ds-base: stack buffer overflow in checkPrefix()
    algorithm ID parsing [fedora-all]
    - Resolves: rhbz#2494830 CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log
    password masking (create_masked_entry_string) [fedora-all]
    - Resolves: rhbz#2498023 CVE-2026-15041 389-ds-base: 389-ds-base: Non-constant-time comparison in
    PBKDF2-SHA256 password verification [fedora-all]


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-0b8bc362b1");
  script_set_attribute(attribute:"solution", value:
"Update the affected 389-ds-base package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-11789");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:43");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:389-ds-base");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^43([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 43', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '43',
    'pkgs': [
      {'reference':'389-ds-base-3.1.5-4.fc43', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, '389-ds-base');
}