Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-76560: A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | 389-ds-base | 0:1.3.10.2-17.amzn2.0.13 |
| Amazon Linux · 2 | 389-ds-base-debuginfo | 0:1.3.10.2-17.amzn2.0.13 |
| Amazon Linux · 2 | 389-ds-base-devel | 0:1.3.10.2-17.amzn2.0.13 |
| Amazon Linux · 2 | 389-ds-base-libs | 0:1.3.10.2-17.amzn2.0.13 |
| Amazon Linux · 2 | 389-ds-base-snmp | 0:1.3.10.2-17.amzn2.0.13 |
Vulnerabilities 1
-
High 7.5
389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-76560.html