CVE-2023-1055

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-1055

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1055.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-1055

Related

Published

2023-02-27T22:15:09Z

Modified

2024-12-09T16:50:31.061403Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

References

Affected packages

Debian:11 / 389-ds-base

Package

Name: 389-ds-base
Purl: pkg:deb/debian/389-ds-base?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.4.4.11-2

1.4.4.16-1

1.4.4.17-1

2.*

2.0.11-1

2.0.11-2

2.0.14-1

2.0.15-1

2.0.15-1.1

2.3.1-1

2.3.1+dfsg1-1

2.3.4+dfsg1-1

2.3.4+dfsg1-1.1

2.4.4+dfsg1-1

2.4.4+dfsg1-3

2.4.5+dfsg1-1

3.*

3.0.2+dfsg1-1

3.1.1+dfsg1-1

3.1.1+dfsg1-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / 389-ds-base