From 3fa64a2b041d9c89498f2bb2fd48055d99661265 Mon Sep 17 00:00:00 2001 From: pkgagent Date: Wed, 22 Jul 2026 16:50:47 +0800 Subject: [PATCH] =?UTF-8?q?Fix=20ITS#10530:=20syncrepl=20-=20detect=20malf?= =?UTF-8?q?ormed=20SYNC=5FID=5FSET=20messages=20to=20prevent=20null=20poin?= =?UTF-8?q?ter=20dereference=E2=80=A6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...ncrepl-detect-malformed-sync-ae04732.patch | 32 +++++++++++++++++++ openldap.spec | 7 +++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 openldap-2.6.5-its-10530-syncrepl-detect-malformed-sync-ae04732.patch diff --git a/openldap-2.6.5-its-10530-syncrepl-detect-malformed-sync-ae04732.patch b/openldap-2.6.5-its-10530-syncrepl-detect-malformed-sync-ae04732.patch new file mode 100644 index 0000000..8960d76 --- /dev/null +++ b/openldap-2.6.5-its-10530-syncrepl-detect-malformed-sync-ae04732.patch @@ -0,0 +1,32 @@ +From ae0473221bb230f2ab95d9d76ed5334bb4d97e6e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= +Date: Tue, 14 Jul 2026 12:21:04 +0100 +Subject: [PATCH] ITS#10530 syncrepl: detect malformed SYNC_ID_SET messages + +--- + servers/slapd/syncrepl.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) +diff --git a/servers/slapd/syncrepl.c b/servers/slapd/syncrepl.c +index 80f73a2..ae6ff1c 100644 +--- a/servers/slapd/syncrepl.c ++++ b/servers/slapd/syncrepl.c +@@ -1897,7 +1897,7 @@ logerr: + syncUUIDs = NULL; + rc = ber_scanf( ber, "[W]", &syncUUIDs ); + ber_scanf( ber, /*"{"*/ "}" ); +- if ( rc != LBER_ERROR ) { ++ if ( rc != LBER_ERROR && syncUUIDs ) { + if ( refreshDeletes ) { + syncrepl_del_nonpresent( op, si, syncUUIDs, + &syncCookie, m ); +@@ -4002,6 +4002,10 @@ presentlist_insert( + { + char *val; + ++ if ( syncUUID->bv_len != UUIDLEN ) { ++ return 1; ++ } ++ + #ifdef HASHUUID + Avlnode **av; + unsigned short s; diff --git a/openldap.spec b/openldap.spec index 8fa9c93..fea134e 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ Summary: An open source implementation of the LDAP Name: openldap Version: 2.6.5 -Release: 6%{?dist} +Release: 7%{?dist} License: OpenLDAP Public License URL: https://www.openldap.org/ Source0: https://openldap.org/software/download/OpenLDAP/openldap-release/%{name}-%{version}.tgz @@ -21,6 +21,7 @@ Source7: check_password.conf Patch0001: ITS-10421-mdb_load-check-for-malicious-input.patch +Patch0002: openldap-2.6.5-its-10530-syncrepl-detect-malformed-sync-ae04732.patch Patch3000: openldap-manpages.patch Patch3001: openldap-reentrant-gethostby.patch @@ -363,6 +364,10 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Wed Jul 22 2026 PkgAgent Robot - 2.6.5-7 +- [Type] security +- [DESC] Fix ITS#10530: syncrepl - detect malformed SYNC_ID_SET messages to prevent null pointer dereference and missing UUID length check + * Mon Jan 12 2026 wynnfeng - 2.6.5-6 - [type] security - [desc] Fix CVE-2026-22185: mdb_load: check for malicious input -- Gitee