A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2173517#c0 | Issue Tracking Vendor Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZOYQ5TCV6ZEPMDV4CSLK3KINAAO4SRI/ |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
07 Nov 2023, 04:02
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
02 Aug 2023, 17:18
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | |
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZOYQ5TCV6ZEPMDV4CSLK3KINAAO4SRI/ - Mailing List |
26 Jul 2023, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2023-02-27 22:15
Updated : 2024-02-28 19:51
NVD link : CVE-2023-1055
Mitre link : CVE-2023-1055
CVE.ORG link : CVE-2023-1055
JSON object : View
Products Affected
fedoraproject
- fedora
redhat
- directory_server