From 897cb09ddf3d6ba5708ec5aa7bc70b564e5cf4d6 Mon Sep 17 00:00:00 2001
From: azban <me@azban.net>
Date: Fri, 10 Apr 2026 01:02:37 -0600
Subject: [PATCH] _389-ds-base: add patch to fix CVE-2025-14905

This patch is in the tree but has not yet been included in a release.
---
 pkgs/by-name/_3/_389-ds-base/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/_3/_389-ds-base/package.nix b/pkgs/by-name/_3/_389-ds-base/package.nix
index dd2da0d95d65..6c7b14d59505 100644
--- a/pkgs/by-name/_3/_389-ds-base/package.nix
+++ b/pkgs/by-name/_3/_389-ds-base/package.nix
@@ -58,6 +58,12 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-trzY/fDH3rs66DWbWI+PY46tIC9ShuVqspMHqEEKZYA=";
     })
     ./0001-remove-hard-coded-vendor-paths.patch
+    (fetchpatch {
+      # https://github.com/389ds/389-ds-base/security/advisories/GHSA-4qwg-c5j2-q4hp
+      name = "CVE-2025-14905.patch";
+      url = "https://github.com/389ds/389-ds-base/commit/2e424110def2e3998f6045e136fb0d43f47b7f5a.patch";
+      hash = "sha256-ItxG0bnuNPWLClL677rChTDvDWXxJ2L6ygx4VY2v80w=";
+    })
   ];
 
   cargoRoot = "src";