[From nobody Wed Nov 4 15:21:08 2026 Received: (at 1139171-close) by bugs.debian.org; 4 Nov 2026 15:19:19 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.0 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,RCVD_IN_DNSWL_MED, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 14; hammy, 150; neutral, 492; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:51740) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xOcli-00B0iz-2l for 1139171-close@bugs.debian.org; Wed, 04 Nov 2026 15:19:19 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xOclh-005mML-02 for 1139171-close@bugs.debian.org; Wed, 04 Nov 2026 15:19:17 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=9Vn9LlWKfCjG/JEqZlE7aBnfijjaemQAg4KmWv6CK5Y=; b=NIIM8DqwJ5XCKE/E8EpFdfdtLi uBxXyqYPz1DYjxGI2fpVtbMaHT4WQQ+zVflQdrTwJbIqlyMXXJvh1tk7wQo5yS7stC26tQG1nunQx Sxf37P5f94p0hdvLEYmL71QS7LEYo5DH482par5J9G6c2DWupm8VOcxjCeTPcVk9u+l0Fgnrlmjmu yRVhnHkWR2dSyWfFd296smjONHLH4C3M5UI5uwnE3srEJBTlmeLnS3YK4wKDNccEdn56p8s1gnpqK SoQ170VceCvCfTIPrD7a5e2Sqcq1yXev5bwa631aeKaT75lBIwP4w3LapqMXf6P/a/fiTm6O3Yp3z sMloXZJQ==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xOclf-00000000Q8T-3LcX; Wed, 04 Nov 2026 15:19:15 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Pierre Gruet <pgt@debian.org> To: 1139171-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: apache-directory-api Debian: DAK Debian-Changes: apache-directory-api_2.1.9-1_source.changes Debian-Source: apache-directory-api Debian-Version: 2.1.9-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1139171: fixed in apache-directory-api 2.1.9-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============1465960514742432446==" Message-Id: <E1xOclf-00000000Q8T-3LcX@fasolo.debian.org> Date: Wed, 04 Nov 2026 15:19:15 +0000 X-CrossAssassin-Score: 2 --===============1465960514742432446== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: apache-directory-api Source-Version: 2.1.9-1 Done: Pierre Gruet <pgt@debian.org> We believe that the bug you reported is fixed in the latest version of apache-directory-api, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1139171@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Pierre Gruet <pgt@debian.org> (supplier of updated apache-directory-api packa= ge) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 04 Nov 2026 15:38:38 +0100 Source: apache-directory-api Architecture: source Version: 2.1.9-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian= .org> Changed-By: Pierre Gruet <pgt@debian.org> Closes: 1139171 1149877 Changes: apache-directory-api (2.1.9-1) unstable; urgency=3Dmedium . * Team upload * New upstream version 2.1.9: - Fixes CVE-2026-35563: It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allows a valid certificate issued for an entirely unrelated host to be improperly accepted. This oversight leaves the connection highly vulnerable to server impersonation and complete connection compromise. The root cause of this vulnerability lies in the incomplete TLS server identity verification within the LDAP client implementation. The attacker requires MITM capability on the network to exploit this vulnerability. This attacker must be able to present a certificate trusted by the client's configured trust store. The hostname verification has been enforced in the new version of the LDAP API. (Closes: #1139171) - Fixes CVE-2026-102731: Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer (or a MITM) can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs (OutOfMemoryError bypasses the DecoderException handlers) or pins the large allocation per connection while the attacker stalls. A handful of connections exhausts any heap. The same bytes from an unauthenticated pre-bind client hit any embedding server that did not set MAX_PDU_SIZE_ATTR. - Fixes CVE-2026-103552: Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. - Fixes CVE-2026-103877: Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some potential RCE. - Fixes CVE-2026-103878: Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. - Fixes CVE-2026-103880: Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced to avoid a server DOS. - Fixes CVE-2026-103885: Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. (Closes: #1149877) * Raising Standards version to 4.7.4: - Removing Priority: optional, which is now defaults * Removing unneeded versioned Build-Dependencies * Updating Build-Dependencies and the Maven rules * Adding a versioned Build-Dependency on mina2 * Switching to debhelper-compat 14, removing misc: substvar * Shipping NoVerificationTrustManager so that it can be used in apache-directory-server * Use secure URI in Homepage field. * Re-export upstream signing key without extra signatures. * Set upstream metadata fields: Bug-Database, Repository. . [ Bastien Roucari=C3=A8s ] * Raising d/watch version to 5 * Add salsa CI Checksums-Sha1: 32b4d51f65a3293f70a09ba435cf6cd6960fc4a2 2501 apache-directory-api_2.1.9-1.d= sc 36095836a9841979115665a46616257521d9be1b 1754864 apache-directory-api_2.1.9.= orig.tar.gz fb4645be9128f48b77c174c6211eebbe0d6f34f7 34028 apache-directory-api_2.1.9-1.= debian.tar.xz 49f37b98b8b6375a6383d29b121ce77019d5bdb4 19287 apache-directory-api_2.1.9-1_= amd64.buildinfo Checksums-Sha256: 4dea229f212ed829ee11c55ddabcf8a613ff73e05a834617f23724751ffdb54c 2501 apache= -directory-api_2.1.9-1.dsc 6912b8ac32a402626af2fc574ba0213198bacd39e98d613a4115a0ab496d502f 1754864 apa= che-directory-api_2.1.9.orig.tar.gz 52a64c81b837d8e72f9d54ed49d2ea96fe2e6870d31276bdf401eccb6a909418 34028 apach= e-directory-api_2.1.9-1.debian.tar.xz 7500e79374eb00ff98b899f85048d609ba91a9d1a3f99ebdb1d1551b7529ebfa 19287 apach= e-directory-api_2.1.9-1_amd64.buildinfo Files: b4cb26935d0c8ff123b3cee268e0c9b6 2501 java optional apache-directory-api_2.1= .9-1.dsc d5cad437eac85253591b9af28303fb10 1754864 java optional apache-directory-api_= 2.1.9.orig.tar.gz 0c9caeca331242102f301630bffe5972 34028 java optional apache-directory-api_2.= 1.9-1.debian.tar.xz 8874d558b426b9a19eab907d6cc0cd60 19287 java optional apache-directory-api_2.= 1.9-1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmrrSacACgkQYAMWptwn dHZ0rQ//Y13njt00x6R9jOBNGRYLlRBbK/LqOEimvvmfgGCOAw3syy3HvaO1j2bS ZEEnbsHcE9/wOIc3NGuUz0Qg96nu1Zh1hOckzp2ZKrh66NRyXQ3GYluwIQz7h6ct DsTFzqFGh8lgSgDacIIDHzqhDBiq2SnAykMjW1MGRqeP8vcpx/sznpPfnXzyomTg S6IwNj3+XuSGYMFi8xBAHviJImoM2s1de8t7FypZIwluTOa0VItH7IGd1w7XnZ+u I6wV3oWQaeY85UzBXgj3JBzRJPRJvYoZoZWBVkkYcjluchmb27aLACVomYq2rpm6 NexGZdpX8hQExhNlDIZmCB7zrRfj5XcznVyN2Bt3inlmwE08nKqZqC0OX4EJWIUp 9XBF1chjqJKRzosBHrZFjOQBxGP5xuQmLk44ZTYCiQJiPd4s430OIPXmiKCU09Rn 7lI1VPu7URccnpYLpsckkTjqGAkvkmO6I0soPV078mccJQ05Fo3cfjhy7VRpRfAG AhvJW1Uiqrb58xcUfcqK4psDlBS3kV8pYQdhE4pd4UqjI8RzW0DyZ3Wg/jCcHYMg z+n7rknDpK6jQ44Nc0xQMH40tLHmWocTleywiRe5w8h31OVAD4CV6HgFtihcbTkY uS79R1aCnE+V9e7caiMENbQtUIrgT2LHWV64bsftVVdmhO9B/S4=3D =3D+82X -----END PGP SIGNATURE----- --===============1465960514742432446== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCautM8wAKCRCb9qggYcy5 ITvnAQCyjK6aAAGZCYNhhIq4gTw2ESIlmxR75zgQrUkdMLx9FQD/bqBJqpIDG8SL ZhtRFDklpWBwVJUr0LIv/HL+ST/sZQs= =ouwF -----END PGP SIGNATURE----- --===============1465960514742432446==-- ]