Executive Summary

CVE-2026-11792 is a heap buffer overflow vulnerability found in the 389 Directory Server's audit logging feature. Specifically, the function create_masked_entry_string() in auditlog.c copies a fixed-length password mask string into a heap buffer that is sized based on the output of slapi_entry2str(). When a short cleartext password (less than 23 characters) is logged, this copy operation overflows the allocated buffer because the function does not check if there is enough space before copying.

This vulnerability can only be triggered under certain conditions: audit logging must be enabled, and either the passwordStorageScheme must be set to CLEAR (which is not the default and generally discouraged) or a compromised replication peer must send short cleartext passwords via replicated ADD operations, bypassing password hashing.

Useful 0 Not Useful 0

Impact Analysis

The heap buffer overflow caused by this vulnerability can corrupt heap memory and audit log output. While production binaries may sometimes absorb the overflow due to allocator padding without immediate crashes, the underlying heap corruption poses a security risk.

The CVSS v3.1 base score is 3.3, indicating a low severity impact with network attack vector, high attack complexity, requiring high privileges, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Potential impacts include integrity and availability issues due to heap corruption, which could lead to unexpected behavior or denial of service in the 389 Directory Server audit logging functionality.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by verifying if audit logging is enabled on the 389 Directory Server and checking the configuration for passwordStorageScheme set to CLEAR or monitoring for replicated ADD operations that send short cleartext passwords.

Since the vulnerability involves a heap buffer overflow in the audit log password masking feature, detection may involve monitoring audit logs for corruption or unusual output patterns.

Specific commands are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include ensuring that audit logging is properly configured and avoiding the use of the non-default CLEAR passwordStorageScheme.

Applying the updated 389-ds-base package that contains the fix for this vulnerability is recommended. The fix has been backported to Red Hat Enterprise Linux 9.6 and RHEL 10.

Users should follow the update instructions provided by Red Hat Product Security advisories to patch their systems.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not explicitly address how this heap buffer overflow vulnerability in 389 Directory Server affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0