CVE-2014-8112
CVE-2014-8112
This page contains facts from public vulnerability sources. Check the original advisory before updating.
389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog.
EPSS 1.7% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
389-ds-base Debian:12
- Affected ranges
- ECOSYSTEM: < 1.3.3.5-4
Update to 1.3.3.5-4
389-ds-base Debian:13
- Affected ranges
- ECOSYSTEM: < 1.3.3.5-4
Update to 1.3.3.5-4
Original sources
- http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-2-27.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1172729
- http://rhn.redhat.com/errata/RHSA-2015-0416.html
- http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-9.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153991.html
- https://nvd.nist.gov/vuln/detail/CVE-2014-8112