Source: 389-ds-base X-Debbugs-CC: t...@security.debian.org Severity: important Tags: security
Hi, The following vulnerability was published for 389-ds-base. CVE-2023-1055[0]: | A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP | tries to decode the userPassword attribute instead of the | userCertificate attribute which could lead into sensitive information | leaked. An attacker with a local account where the cockpit-389-ds is | running can list the processes and display the hashed passwords. The | highest threat from this vulnerability is to data confidentiality. https://bugzilla.redhat.com/show_bug.cgi?id=2173517 If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-1055 https://www.cve.org/CVERecord?id=CVE-2023-1055 Please adjust the affected versions in the BTS as needed.
