CVE-2018-10871
CVE-2018-10871
This page contains facts from public vulnerability sources. Check the original advisory before updating.
389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.
CVSS 3.8 · Low · EPSS 1.1% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
389-ds-base
- Versions
- 389-ds-base 1.3.8.5: Affected
- 389-ds-base 1.4.0.12: Affected
No fix published
389-ds-base Debian:12
- Affected ranges
- ECOSYSTEM: < 1.4.0.15-1
Update to 1.4.0.15-1
389-ds-base Debian:13
- Affected ranges
- ECOSYSTEM: < 1.4.0.15-1
Update to 1.4.0.15-1
389-ds-base Ubuntu:Pro:16.04:LTS
- Versions
- 1.3.3.12-1build1
- 1.3.3.13-1
- 1.3.4.5-2
- 1.3.4.8-1
- 1.3.4.8-3
- 1.3.4.8-3ubuntu1
- 1.3.4.8-4
- 1.3.4.9-1
- 1.3.4.9-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
389-ds-base Ubuntu:Pro:18.04:LTS
- Versions
- 1.3.7.5-1
- 1.3.7.5-1build1
- 1.3.7.5-1build2
- 1.3.7.9-1
- 1.3.7.10-1
- 1.3.7.10-1ubuntu1
- 1.3.7.10-1ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
389-ds-base Ubuntu:26.04:LTS
- Versions
- 3.1.2+dfsg1-1
- 3.1.2+vendor1-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published