# CVE-2024-3657: 389-ds: This update for 389-ds fixes the following issues: - Persist extracted key path for ldap_ssl_client_init over repeat... CVE-2024-3657 is fixed in 7 products on 1 platform, first by DEBIAN-CVE-2024-3657, released May 28, 2024. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2024-3657 - Priority: High - CVSS: 7.5 (Important) - EPSS: 0.0128 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: May 28, 2024 ## Description This update for 389-ds fixes the following issues: - Persist extracted key path for ldap_ssl_client_init over repeat invocations (bsc#1230852) - Re-enable use of .dsrc basedn for dsidm commands (bsc#1231462) - Update to version 2.2.10~git18.20ce9289: * RFE: Use previously extracted key path * Update dsidm to prioritize basedn from .dsrc over interactive input * UI: Instance fails to load when DB backup directory doesn't exist * Improve online import robustness when the server is under load * Ensure all slapi_log_err calls end format strings with newline character \n * RFE: when memberof is enabled, defer updates of members from the update of the group * Provide more information in the error message during setup_ol_tls_conn() * Wrong set of entries returned for some search filters * Schema lib389 object is not keeping custom schema data upon editing * UI: Fix audit issue with npm - micromatch * Fix long delay when setting replication agreement with dsconf * Changelog trims updates from a given RID even if a consumer has not received any of them * test_password_modify_non_utf8 should set default password storage scheme * Update Cargo.lock * Rearrange includes for 32-bit support logic * Fix fedora cop RawHide builds * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console * Enabling replication for a sub suffix crashes browser * d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes * Slow ldif2db import on a newly created BDB backend * Audit log buffering doesn't handle large updates * RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) * passwordHistory is not updated with a pre-hashed password * ns-slapd crash in referint_get_config * Fix the UTC offset print * Fix OpenLDAP version autodetection * RFE: add new operation note for MFA authentications * Add log buffering to audit log * Fix connection timeout error breaking errormap * Improve dsidm CLI No Such Entry handling * Improve connection timeout error logging * Add hidden -v and -j options to each CLI subcommand * Fix various issues with logconv.pl * Fix certificate lifetime displayed as NaN * Enhance Rust and JS bundling and add SPDX licenses for both * Remove audit-ci from dependencies * Fix unused variable warning from previous commit * covscan: fix memory leak in audit log when adding entries * Add a check for tagged commits * dscreate ds-root - accepts relative path * Change replica_id from str to int * Attribute Names changed to lowercase after adding the Attributes * ns-slapd crashes at startup if a backend has no suffix * During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it * Reversion of the entry cache should be limited to BETXN plugin failures * Disable Transparent Huge Pages * Freelist ordering causes high wtime * Security fix for CVE-2024-2199 - VUL-0: CVE-2024-3657: 389-ds: potential denial of service via specially crafted kerberos AS-REQ request (bsc#1225512) - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword hashes may cause a denial of service (bsc#1226277) - 389ds crash when user does change password using iso-8859-1 encoding (bsc#1228912) ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | 389-ds opensuse-leap 15.6 | 2.2.10~git18.20ce9289-150600.8.10.1 | [SUSE-SU-2024:3844-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3844-1.md) | Oct 31, 2024 | | Linux | 389-ds sles 15.6 | 2.2.10~git18.20ce9289-150600.8.10.1 | [SUSE-SU-2024:3844-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3844-1.md) | Oct 31, 2024 | | Linux | 389-ds-base Debian 12.15 (bookworm) | 2.3.1+dfsg1-1+deb12u1 | [DEBIAN-CVE-2024-3657](https://patchblox.com/security/data/fix/linux/debian-cve-2024-3657.md) | May 28, 2024 | | Linux | 389-ds-base Debian 13.5 (trixie) | 3.1.1+dfsg1-1 | [DEBIAN-CVE-2024-3657](https://patchblox.com/security/data/fix/linux/debian-cve-2024-3657.md) | May 28, 2024 | | Linux | 389-ds-base RHEL 8 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb | [RHSA-2024:4235](https://patchblox.com/security/data/fix/linux/rhsa-2024-4235.md) | Jul 2, 2024 | | Linux | 389-ds-base RHEL 9 | 0:2.4.5-8.el9_4 | [RHSA-2024:3837](https://patchblox.com/security/data/fix/linux/rhsa-2024-3837.md) | Jun 11, 2024 | | Linux | 389-ds-base almalinux 8 | 1.4.3.39-7.module_el8.10.0+3864+d8eec553 | [ALSA-2024:4235](https://patchblox.com/security/data/fix/linux/alsa-2024-4235.md) | Jul 2, 2024 | | Linux | 389-ds-base almalinux 9 | 2.4.5-8.el9_4 | [ALSA-2024:3837](https://patchblox.com/security/data/fix/linux/alsa-2024-3837.md) | Jun 11, 2024 | | Linux | 389-ds-base ol 8 | 0:1.4.3.39-7.module+el8.10.0+90358+1275b17f | [ELSA-2024-4235](https://patchblox.com/security/data/fix/linux/elsa-2024-4235.md) | Jul 3, 2024 | | Linux | 389-ds-base ol 9 | 0:2.4.5-8.el9_4 | [ELSA-2024-3837](https://patchblox.com/security/data/fix/linux/elsa-2024-3837.md) | Jun 12, 2024 | | Linux | 389-ds-base rocky 8 | 0:1.4.3.39-7.module+el8.10.0+1832+2f5a9255 | [RLSA-2024:4235](https://patchblox.com/security/data/fix/linux/rlsa-2024-4235.md) | Jul 15, 2024 | | Linux | 389-ds-base rocky 9 | 0:2.4.5-8.el9_4 | [RLSA-2024:3837](https://patchblox.com/security/data/fix/linux/rlsa-2024-3837.md) | Jun 14, 2024 | | Linux | 389-ds-base-devel RHEL 8 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb | [RHSA-2024:4235](https://patchblox.com/security/data/fix/linux/rhsa-2024-4235.md) | Jul 2, 2024 | | Linux | 389-ds-base-devel RHEL 9 | 0:2.4.5-8.el9_4 | [RHSA-2024:3837](https://patchblox.com/security/data/fix/linux/rhsa-2024-3837.md) | Jun 11, 2024 | | Linux | 389-ds-base-devel almalinux 8 | 1.4.3.39-7.module_el8.10.0+3864+d8eec553 | [ALSA-2024:4235](https://patchblox.com/security/data/fix/linux/alsa-2024-4235.md) | Jul 2, 2024 | | Linux | 389-ds-base-devel almalinux 9 | 2.4.5-8.el9_4 | [ALSA-2024:3837](https://patchblox.com/security/data/fix/linux/alsa-2024-3837.md) | Jun 11, 2024 | | Linux | 389-ds-base-devel ol 8 | 0:1.4.3.39-7.module+el8.10.0+90358+1275b17f | [ELSA-2024-4235](https://patchblox.com/security/data/fix/linux/elsa-2024-4235.md) | Jul 3, 2024 | | Linux | 389-ds-base-devel ol 9 | 0:2.4.5-8.el9_4 | [ELSA-2024-3837](https://patchblox.com/security/data/fix/linux/elsa-2024-3837.md) | Jun 12, 2024 | | Linux | 389-ds-base-legacy-tools RHEL 8 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb | [RHSA-2024:4235](https://patchblox.com/security/data/fix/linux/rhsa-2024-4235.md) | Jul 2, 2024 | | Linux | 389-ds-base-legacy-tools almalinux 8 | 1.4.3.39-7.module_el8.10.0+3864+d8eec553 | [ALSA-2024:4235](https://patchblox.com/security/data/fix/linux/alsa-2024-4235.md) | Jul 2, 2024 | | Linux | 389-ds-base-legacy-tools ol 8 | 0:1.4.3.39-7.module+el8.10.0+90358+1275b17f | [ELSA-2024-4235](https://patchblox.com/security/data/fix/linux/elsa-2024-4235.md) | Jul 3, 2024 | | Linux | 389-ds-base-libs RHEL 8 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb | [RHSA-2024:4235](https://patchblox.com/security/data/fix/linux/rhsa-2024-4235.md) | Jul 2, 2024 | | Linux | 389-ds-base-libs RHEL 9 | 0:2.4.5-8.el9_4 | [RHSA-2024:3837](https://patchblox.com/security/data/fix/linux/rhsa-2024-3837.md) | Jun 11, 2024 | | Linux | 389-ds-base-libs almalinux 8 | 1.4.3.39-7.module_el8.10.0+3864+d8eec553 | [ALSA-2024:4235](https://patchblox.com/security/data/fix/linux/alsa-2024-4235.md) | Jul 2, 2024 | | Linux | 389-ds-base-libs almalinux 9 | 2.4.5-8.el9_4 | [ALSA-2024:3837](https://patchblox.com/security/data/fix/linux/alsa-2024-3837.md) | Jun 11, 2024 | | Linux | 389-ds-base-libs ol 8 | 0:1.4.3.39-7.module+el8.10.0+90358+1275b17f | [ELSA-2024-4235](https://patchblox.com/security/data/fix/linux/elsa-2024-4235.md) | Jul 3, 2024 | | Linux | 389-ds-base-libs ol 9 | 0:2.4.5-8.el9_4 | [ELSA-2024-3837](https://patchblox.com/security/data/fix/linux/elsa-2024-3837.md) | Jun 12, 2024 | | Linux | 389-ds-base-snmp RHEL 8 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb | [RHSA-2024:4235](https://patchblox.com/security/data/fix/linux/rhsa-2024-4235.md) | Jul 2, 2024 | | Linux | 389-ds-base-snmp almalinux 8 | 1.4.3.39-7.module_el8.10.0+3864+d8eec553 | [ALSA-2024:4235](https://patchblox.com/security/data/fix/linux/alsa-2024-4235.md) | Jul 2, 2024 | | Linux | 389-ds-base-snmp ol 8 | 0:1.4.3.39-7.module+el8.10.0+90358+1275b17f | [ELSA-2024-4235](https://patchblox.com/security/data/fix/linux/elsa-2024-4235.md) | Jul 3, 2024 | | Linux | python3-lib389 RHEL 8 | 0:1.4.3.39-7.module+el8.10.0+21985+3665ccdb | [RHSA-2024:4235](https://patchblox.com/security/data/fix/linux/rhsa-2024-4235.md) | Jul 2, 2024 | | Linux | python3-lib389 RHEL 9 | 0:2.4.5-8.el9_4 | [RHSA-2024:3837](https://patchblox.com/security/data/fix/linux/rhsa-2024-3837.md) | Jun 11, 2024 | | Linux | python3-lib389 almalinux 8 | 1.4.3.39-7.module_el8.10.0+3864+d8eec553 | [ALSA-2024:4235](https://patchblox.com/security/data/fix/linux/alsa-2024-4235.md) | Jul 2, 2024 | | Linux | python3-lib389 almalinux 9 | 2.4.5-8.el9_4 | [ALSA-2024:3837](https://patchblox.com/security/data/fix/linux/alsa-2024-3837.md) | Jun 11, 2024 | | Linux | python3-lib389 ol 8 | 0:1.4.3.39-7.module+el8.10.0+90358+1275b17f | [ELSA-2024-4235](https://patchblox.com/security/data/fix/linux/elsa-2024-4235.md) | Jul 3, 2024 | | Linux | python3-lib389 ol 9 | 0:2.4.5-8.el9_4 | [ELSA-2024-3837](https://patchblox.com/security/data/fix/linux/elsa-2024-3837.md) | Jun 12, 2024 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.