Published: 27/02/2023 Updated: 07/11/2023

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 0

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat directory server 12.0
redhat directory server 12.1
redhat directory server 11.5
redhat directory server 11.6
fedoraproject fedora 36
fedoraproject fedora 37
fedoraproject fedora 38

Debian Bug report logs - #1034891 389-ds-base: CVE-2023-1055 Package: src:389-ds-base; Maintainer for src:389-ds-base is Debian FreeIPA Team <pkg-freeipa-devel@alioth-listsdebiannet>; Reported by: Moritz Mühlenhoff <jmm@inutilorg> Date: Wed, 26 Apr 2023 17:45:04 UTC Severity: important Tags: security, upstream ...

Synopsis Moderate: redhat-ds:11 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the redhat-ds:11 module is now available for Red Hat Directory Server 116 for RHEL 8 ...

Synopsis Moderate: redhat-ds:12 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the redhat-ds:12 module is now available for Red Hat Directory Server 121 for RHEL 9 ...

DescriptionA flaw was found in RHDS 11 and 12 While browsing entries, LDAP tries to decode the userPassword attribute instead of the userCertificate attribute, which could lead into sensitive information being leaked This issue could allow an attacker with a local account with cockpit-389-ds running to list processes and display hashed pas ...

CWE-295 https://bugzilla.redhat.com/show_bug.cgi?id=2173517#c0 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZOYQ5TCV6ZEPMDV4CSLK3KINAAO4SRI/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034891 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2023-1055

CVE-2023-1055

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect