Bug#1143603: 389-ds-base: CVE-2026-18651

Source: 389-ds-base
Version: 3.1.2+vendor1-2
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerability was published for 389-ds-base.

CVE-2026-18651[0]:
| A flaw was found in 389 Directory Server. During SASL PLAIN
| authentication, the server installs connection-level bind
| credentials before performing the account-lock check. If the account
| is subsequently found to be locked, the bind is reported as failed
| to the client, but the already-installed authenticated state on the
| connection is not reverted. A client that supplies valid credentials
| for an account that has been administratively locked can continue to
| use the same connection with that account's privileges, defeating
| account lock as an access-revocation control.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-18651
    https://www.cve.org/CVERecord?id=CVE-2026-18651
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2510617

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore