Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-1055

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Published

2023-02-27T22:15:09.990

Last Modified

2024-11-21T07:38:22.297

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.5 (MEDIUM)

Weaknesses

Type: Secondary
CWE-200
Type: Primary
CWE-295

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	redhat	directory_server	11.5	Yes
Application	redhat	directory_server	11.6	Yes
Application	redhat	directory_server	12.0	Yes
Application	redhat	directory_server	12.1	Yes
Operating System	fedoraproject	fedora	36	Yes
Operating System	fedoraproject	fedora	37	Yes
Operating System	fedoraproject	fedora	38	Yes

References

https://bugzilla.redhat.com/show_bug.cgi?id=2173517#c0 Issue Tracking, Vendor Advisory ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZOYQ5TCV6ZEPMDV4CSLK3KINAAO4SRI/ ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=2173517#c0 Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZOYQ5TCV6ZEPMDV4CSLK3KINAAO4SRI/ (af854a3a-2127-422b-91ae-364da2661108)