REDHAT-BUG-2485427: Medium severity 389 Project 389-ds-base vulnerability

Published Jun 5, 2026

Updated

A type confusion bug in extophandleldapssotokenrequest() (extendop.c) passes a stack pointer (&rc) to berprintf with format 'i' which expects an integer. The low 32 bits of a stack address are encoded into every SSO token LDAP extended operation response.

Any authenticated non-administrator user can extract partial stack address information. SSO token feature enabled by default with auto-generated secret (Issue #1797). PoC confirmed on Fedora 42: INTEGER=0x8e7faed8 leaked. Reduces stack ASLR entropy but is not a full bypass.

Affected Software

1 affected component

389 Project 389-ds-base

Event History

Jun 5, 2026

Data Sourced

via Red Hat·12:25 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2485427?

The severity of REDHAT-BUG-2485427 is medium with a CVSS score of 4.

What is the main issue with REDHAT-BUG-2485427?

The main issue with REDHAT-BUG-2485427 is a type confusion bug in the extop_handle_ldapssotoken_request() function that improperly handles stack pointers.

Who is affected by REDHAT-BUG-2485427?

Any authenticated non-administrator user may be affected by REDHAT-BUG-2485427.

How do I fix REDHAT-BUG-2485427?

To fix REDHAT-BUG-2485427, you should apply the patches provided by the 389 Project.

What software is impacted by REDHAT-BUG-2485427?

REDHAT-BUG-2485427 impacts the 389 Project's 389-ds-base software.