REDHAT-BUG-2484915: Buffer Overflow
A heap buffer overflow exists in 389 Directory Server's audit log password masking feature. The createmaskedentrystring() function (auditlog.c:109) uses strcpy to write a fixed 24-byte mask string into a precisely-sized heap buffer from slapientry2str(). When a password value is shorter than 23 characters, the copy overflows past the allocated buffer boundary.
Trigger conditions require non-default configuration: audit logging enabled AND either passwordStorageScheme=CLEAR (explicitly discouraged) or a compromised replication peer sending short cleartext passwords via replicated ADD (replop bypasses password hashing).
Introduced by commit bfeaa8d (Issue 6884, July 2025) and backported to RHEL 9.6 (RHEL-109954) and RHEL 10 (RHEL-107035). Not present in RHEL 7, RHEL 8, or RHEL 9.0-9.5.
Production testing: heap corruption confirmed in audit log output on live server; ASan PoC confirms overflow. Production binaries may absorb overflow in allocator padding without immediate crash.
Advisory: 389-ds-campaign-2026-04/006-Auditlog-Heap-Overflow/advisory.md. Source: PSIRTSUPT-7600 (Ian Murphy, Red Hat Product Security).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
389 Directory Server (audit log password masking feature)to a version that resolves this vulnerability.Fixed in RHEL 9.6Patch RHEL-109954 - Upgrade
Upgrade
389 Directory Server (audit log password masking feature)to a version that resolves this vulnerability.Fixed in RHEL 10Patch RHEL-107035 - Configuration
Disable audit logging unless required, because the heap buffer overflow is in 389 Directory Server's audit log password masking feature and is triggered only when audit logging is enabled.
389 Directory Server audit logging audit logging enabled = false - Configuration
Avoid triggering the vulnerable replication path: ensure replicated ADD operations do not carry short cleartext passwords where repl_op bypasses password hashing; if possible, remediate the replication peer/configuration so CLEAR passwordStorageScheme (discouraged) or short cleartext passwords via replicated ADD are not used.
389 Directory Server replication repl_op password handling = do not bypass password hashing - Compensating control
If you must keep the system reachable, mitigate exploitability by reducing exposure of the audit logging feature triggers: prevent compromised replication peers from sending cleartext passwords via replicated ADD (e.g., restrict/monitor replication connectivity so only trusted peers can replicate).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2484915?
The severity of REDHAT-BUG-2484915 is classified as low.
What is the nature of the vulnerability in REDHAT-BUG-2484915?
REDHAT-BUG-2484915 is a heap buffer overflow related to the audit log password masking feature in 389 Directory Server.
How do I fix REDHAT-BUG-2484915?
To fix REDHAT-BUG-2484915, update the Red Hat 389 Directory Server to the latest patched version provided by Red Hat.
Which software is affected by REDHAT-BUG-2484915?
REDHAT-BUG-2484915 affects Red Hat 389 Directory Server and Red Hat Enterprise Linux versions 9.6 and 10.
What function is responsible for the vulnerability in REDHAT-BUG-2484915?
The create_masked_entry_string() function is responsible for the heap buffer overflow in REDHAT-BUG-2484915.