You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@directory.apache.org by el...@apache.org on 2026/10/02 13:37:03 UTC
(directory-site) branch master updated (a9b7ba53 -> bd0e4c76)
This is an automated email from the ASF dual-hosted git repository.
elecharny pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/directory-site.git
from a9b7ba53 Announced the Apache LDAP API 2.1.9 release
new 6214bacb Added a new menu entry pointing to the projects' vulnerabilities
new bd0e4c76 Announed the 6 recent CVEs for LDAP API
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
layouts/apacheds/baseof.html | 1 +
layouts/api/baseof.html | 1 +
layouts/fortress/baseof.html | 1 +
layouts/kerby/baseof.html | 1 +
layouts/mavibot/baseof.html | 1 +
layouts/scimple/baseof.html | 1 +
layouts/studio/baseof.html | 1 +
source/api/news.md | 18 ++++++++++++++++--
8 files changed, 23 insertions(+), 2 deletions(-)
(directory-site) 01/02: Added a new menu entry pointing to the projects' vulnerabilities
Posted by el...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
elecharny pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/directory-site.git
commit 6214bacb58c7a5794c637707580928da197fcb7c
Author: emmanuel lecharny <el...@apache.org>
AuthorDate: Fri Oct 2 15:36:29 2026 +0200
Added a new menu entry pointing to the projects' vulnerabilities
---
layouts/apacheds/baseof.html | 1 +
layouts/api/baseof.html | 1 +
layouts/fortress/baseof.html | 1 +
layouts/kerby/baseof.html | 1 +
layouts/mavibot/baseof.html | 1 +
layouts/scimple/baseof.html | 1 +
layouts/studio/baseof.html | 1 +
7 files changed, 7 insertions(+)
diff --git a/layouts/apacheds/baseof.html b/layouts/apacheds/baseof.html
index d2763b2b..6d814ca0 100644
--- a/layouts/apacheds/baseof.html
+++ b/layouts/apacheds/baseof.html
@@ -37,6 +37,7 @@
<ul>
<li><a href="/apacheds/">Home</a></li>
<li><a href="/apacheds/news.html">News</a></li>
+ <li><a href="https://security.apache.org/projects/directory/">Security Advisories</a></li>
<li><a href="/apacheds/features.html">Features</a></li>
<li><a href="/apacheds/production-readiness.html">Production Readiness</a></li>
</ul>
diff --git a/layouts/api/baseof.html b/layouts/api/baseof.html
index ea8c178b..7b00e5be 100644
--- a/layouts/api/baseof.html
+++ b/layouts/api/baseof.html
@@ -37,6 +37,7 @@
<ul>
<li><a href="/api/">Home</a></li>
<li><a href="/api/news.html">News</a></li>
+ <li><a href="https://security.apache.org/projects/directory/">Security Advisories</a></li>
</ul>
<h5>Downloads</h5>
diff --git a/layouts/fortress/baseof.html b/layouts/fortress/baseof.html
index 6673fa18..2f5453e2 100644
--- a/layouts/fortress/baseof.html
+++ b/layouts/fortress/baseof.html
@@ -38,6 +38,7 @@
<li><a href="/fortress/">Home</a></li>
<li><a href="/fortress/history.html">History</a></li>
<li><a href="/fortress/news.html">News</a></li>
+ <li><a href="https://security.apache.org/projects/directory/">Security Advisories</a></li>
</ul>
<h5>Downloads</h5>
diff --git a/layouts/kerby/baseof.html b/layouts/kerby/baseof.html
index e3298ac5..e8084fb2 100644
--- a/layouts/kerby/baseof.html
+++ b/layouts/kerby/baseof.html
@@ -30,6 +30,7 @@
<ul>
<li><a href="/kerby/">Home</a></li>
<li><a href="/kerby/news.html">News</a></li>
+ <li><a href="https://security.apache.org/projects/directory/">Security Advisories</a></li>
<li><a href="/kerby/features.html">Features</a></li>
</ul>
diff --git a/layouts/mavibot/baseof.html b/layouts/mavibot/baseof.html
index 74132057..792efef8 100644
--- a/layouts/mavibot/baseof.html
+++ b/layouts/mavibot/baseof.html
@@ -37,6 +37,7 @@
<ul>
<li><a href="/mavibot/">Home</a></li>
<li><a href="/mavibot/news.html">News</a></li>
+ <li><a href="https://security.apache.org/projects/directory/">Security Advisories</a></li>
</ul>
<h5>Downloads</h5>
diff --git a/layouts/scimple/baseof.html b/layouts/scimple/baseof.html
index 94dd9ebd..0c653b38 100644
--- a/layouts/scimple/baseof.html
+++ b/layouts/scimple/baseof.html
@@ -37,6 +37,7 @@
<ul>
<li><a href="/scimple/">Home</a></li>
<li><a href="/scimple/news.html">News</a></li>
+ <li><a href="https://security.apache.org/projects/directory/">Security Advisories</a></li>
</ul>
<h5>Downloads</h5>
<ul>
diff --git a/layouts/studio/baseof.html b/layouts/studio/baseof.html
index d8569254..71c00014 100644
--- a/layouts/studio/baseof.html
+++ b/layouts/studio/baseof.html
@@ -37,6 +37,7 @@
<ul>
<li><a href="/studio/">Home</a></li>
<li><a href="/studio/news.html">News</a></li>
+ <li><a href="https://security.apache.org/projects/directory/">Security Advisories</a></li>
<li><a href="/studio/screenshots.html">Screenshots</a></li>
</ul>
(directory-site) 02/02: Announed the 6 recent CVEs for LDAP API
Posted by el...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
elecharny pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/directory-site.git
commit bd0e4c76c4e75e80c129de681c448f25419fadf7
Author: emmanuel lecharny <el...@apache.org>
AuthorDate: Fri Oct 2 15:36:55 2026 +0200
Announed the 6 recent CVEs for LDAP API
---
source/api/news.md | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/source/api/news.md b/source/api/news.md
index 434c56ca..03fec62c 100644
--- a/source/api/news.md
+++ b/source/api/news.md
@@ -4,9 +4,23 @@ title: News
# News
-<h2 class="news">Apache Directory LDAP API 2.1.9 released <em>posted on Sep 28th, 2026</em></h2>
+<h2 class="news">Apache Directory LDAP API 2.1.9 CVEs and release <em>posted on Oct 3nd, 2026</em></h2>
-This release fixes many issues found by *Glasswind* and *Claude* analysis.
+The following vulnerabilities have been fixed in the latest release.
+
+Users are urged to upgrade to *Apache LDAP API 2.1.9* which contains fixes for those vulnerabilities, and many others
+
+## Vulnerabilities
+
+* [CVE-2026-102731](https://www.cve.org/CVERecord?id=CVE-2026-102731): Denial of service via excessive memory allocation in BER decode
+* [CVE-2026-103552](https://www.cve.org/CVERecord?id=CVE-2026-103552): A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder
+
+* [CVE-2026-103877](https://www.cve.org/CVERecord?id=CVE-2026-103877): Unsafe loading of Java code from LDAP schema elements
+* [CVE-2026-103878](https://www.cve.org/CVERecord?id=CVE-2026-103878): Injection of plaintext responses during StartTLS
+* [CVE-2026-103880](https://www.cve.org/CVERecord?id=CVE-2026-103880): Denial of service via excessive bcrypt cost factor in stored passwords
+* [CVE-2026-103885](https://www.cve.org/CVERecord?id=CVE-2026-103885): Denial of service via crafted telephone number values
+
+This release also fixes many issues found by *Glasswind* and *Claude* analysis.
Here is the list of the found and fixed issues: