CVE-2023-1055 | BDVDB-2026-196300 Detail

Red Hat Directory Server

Description#

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References#

https://bugzilla.redhat.com/show_bug.cgi?id=2173517#c0
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZOYQ5TCV6ZEPMDV4CSLK3KINAAO4SRI/

Exploit#

No public exploit known

History#

Version 12023-02-27Record published in the CVE List.
Version 22025-03-11Most recent update recorded in the CVE List.