apache-directory-api_2.1.9-1_source.changes ACCEPTED into unstable
Debian FTP Masters
ftpmaster at ftp-master.debian.org
Wed Nov 4 15:19:15 GMT 2026
Thank you for your contribution to Debian.
Accepted:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 04 Nov 2026 15:38:38 +0100
Source: apache-directory-api
Architecture: source
Version: 2.1.9-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers at lists.alioth.debian.org>
Changed-By: Pierre Gruet <pgt at debian.org>
Closes: 1139171 1149877
Changes:
apache-directory-api (2.1.9-1) unstable; urgency=medium
.
* Team upload
* New upstream version 2.1.9:
- Fixes CVE-2026-35563:
It was identified that the LDAP client implementation in version
2.1.7 does not verify if the server certificate matches the intended
LDAP hostname. While the underlying code validates the certificate
chain against a trusted authority, the absence of endpoint
identification allows a valid certificate issued for an entirely
unrelated host to be improperly accepted. This oversight leaves the
connection highly vulnerable to server impersonation and complete
connection compromise. The root cause of this vulnerability lies
in the incomplete TLS server identity verification within the LDAP
client implementation. The attacker requires MITM capability on
the network to exploit this vulnerability. This attacker must be
able to present a certificate trusted by the client's configured
trust store. The hostname verification has been enforced in the
new version of the LDAP API.
(Closes: #1139171)
- Fixes CVE-2026-102731:
Memory allocation with excessive size value vulnerability in Apache
Directory LDAP API. A malicious peer (or a MITM) can send a small
BER-encoded response causing a large memory allocation before any
data is received. This can lead to an OutOfMemoryError and denial of
service. The client JVM OOMs (OutOfMemoryError bypasses the
DecoderException handlers) or pins the large allocation per
connection while the attacker stalls. A handful of connections
exhausts any heap. The same bytes from an unauthenticated pre-bind
client hit any embedding server that did not set MAX_PDU_SIZE_ATTR.
- Fixes CVE-2026-103552:
Stack Overflow vulnerability in Apache Directory LDAP API. Before
binding, a client can send a deeply nested search filter that
overflows the stack in the server's decoder.
- Fixes CVE-2026-103877:
Deserialization of Untrusted Data vulnerability in Apache Directory
LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can
answer a client's loadSchema() subschema search with a schema object
that contains a serialized Java class, allowing some potential RCE.
- Fixes CVE-2026-103878:
Cleartext transmission of sensitive information vulnerability in
Apache Directory LDAP API. A StartTLS extended operation started
after a Search request has been sent can lead to receive data in
plain text before the TLS Handshake has been completed.
- Fixes CVE-2026-103880:
Asymmetric Resource Consumption vulnerability in Apache Directory
LDAP API. Storing a password using the bcrypt algorithm with a
high force like 30 in a LDAP server that supports this algorithm
will cause the server CPU to run for hours checking the
credentials. A bounded cost should be enforced to avoid a server
DOS.
- Fixes CVE-2026-103885:
Asymmetric Resource Consumption vulnerability in Apache Directory
LDAP API. A LDAP server using the LDAP API (like Apache DS) may
consume 100% of a CPU core indefinitely when processing some badly
crafted Telephone Numbers.
(Closes: #1149877)
* Raising Standards version to 4.7.4:
- Removing Priority: optional, which is now defaults
* Removing unneeded versioned Build-Dependencies
* Updating Build-Dependencies and the Maven rules
* Adding a versioned Build-Dependency on mina2
* Switching to debhelper-compat 14, removing misc: substvar
* Shipping NoVerificationTrustManager so that it can be used in
apache-directory-server
* Use secure URI in Homepage field.
* Re-export upstream signing key without extra signatures.
* Set upstream metadata fields: Bug-Database, Repository.
.
[ Bastien Roucariès ]
* Raising d/watch version to 5
* Add salsa CI
Checksums-Sha1:
32b4d51f65a3293f70a09ba435cf6cd6960fc4a2 2501 apache-directory-api_2.1.9-1.dsc
36095836a9841979115665a46616257521d9be1b 1754864 apache-directory-api_2.1.9.orig.tar.gz
fb4645be9128f48b77c174c6211eebbe0d6f34f7 34028 apache-directory-api_2.1.9-1.debian.tar.xz
49f37b98b8b6375a6383d29b121ce77019d5bdb4 19287 apache-directory-api_2.1.9-1_amd64.buildinfo
Checksums-Sha256:
4dea229f212ed829ee11c55ddabcf8a613ff73e05a834617f23724751ffdb54c 2501 apache-directory-api_2.1.9-1.dsc
6912b8ac32a402626af2fc574ba0213198bacd39e98d613a4115a0ab496d502f 1754864 apache-directory-api_2.1.9.orig.tar.gz
52a64c81b837d8e72f9d54ed49d2ea96fe2e6870d31276bdf401eccb6a909418 34028 apache-directory-api_2.1.9-1.debian.tar.xz
7500e79374eb00ff98b899f85048d609ba91a9d1a3f99ebdb1d1551b7529ebfa 19287 apache-directory-api_2.1.9-1_amd64.buildinfo
Files:
b4cb26935d0c8ff123b3cee268e0c9b6 2501 java optional apache-directory-api_2.1.9-1.dsc
d5cad437eac85253591b9af28303fb10 1754864 java optional apache-directory-api_2.1.9.orig.tar.gz
0c9caeca331242102f301630bffe5972 34028 java optional apache-directory-api_2.1.9-1.debian.tar.xz
8874d558b426b9a19eab907d6cc0cd60 19287 java optional apache-directory-api_2.1.9-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmrrSacACgkQYAMWptwn
dHZ0rQ//Y13njt00x6R9jOBNGRYLlRBbK/LqOEimvvmfgGCOAw3syy3HvaO1j2bS
ZEEnbsHcE9/wOIc3NGuUz0Qg96nu1Zh1hOckzp2ZKrh66NRyXQ3GYluwIQz7h6ct
DsTFzqFGh8lgSgDacIIDHzqhDBiq2SnAykMjW1MGRqeP8vcpx/sznpPfnXzyomTg
S6IwNj3+XuSGYMFi8xBAHviJImoM2s1de8t7FypZIwluTOa0VItH7IGd1w7XnZ+u
I6wV3oWQaeY85UzBXgj3JBzRJPRJvYoZoZWBVkkYcjluchmb27aLACVomYq2rpm6
NexGZdpX8hQExhNlDIZmCB7zrRfj5XcznVyN2Bt3inlmwE08nKqZqC0OX4EJWIUp
9XBF1chjqJKRzosBHrZFjOQBxGP5xuQmLk44ZTYCiQJiPd4s430OIPXmiKCU09Rn
7lI1VPu7URccnpYLpsckkTjqGAkvkmO6I0soPV078mccJQ05Fo3cfjhy7VRpRfAG
AhvJW1Uiqrb58xcUfcqK4psDlBS3kV8pYQdhE4pd4UqjI8RzW0DyZ3Wg/jCcHYMg
z+n7rknDpK6jQ44Nc0xQMH40tLHmWocTleywiRe5w8h31OVAD4CV6HgFtihcbTkY
uS79R1aCnE+V9e7caiMENbQtUIrgT2LHWV64bsftVVdmhO9B/S4=
=+82X
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20261104/5ad546e8/attachment.sig>
More information about the pkg-java-maintainers
mailing list