CVE-2014-8112
It was found that when the nsslapd-unhashed-pw-switch 389 Directory Server configuration option was set to "off", it did not prevent the writing of unhashed passwords into the Changelog. This could potentially allow an authenticated user able to access the Changelog to read sensitive information.
Find out more about CVE-2014-8112 from the MITRE CVE dictionary dictionary and NIST NVD.
Statement
This issue did not affect the versions of 389-ds-base as shipped with Red Hat Enterprise Linux 6.
CVSS v2 metrics
| Base Score | 1.4 |
|---|---|
| Base Metrics | AV:A/AC:H/Au:S/C:P/I:N/A:N |
| Access Vector | Adjacent Network |
| Access Complexity | High |
| Authentication | Single |
| Confidentiality Impact | Partial |
| Integrity Impact | None |
| Availability Impact | None |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Enterprise Linux 7 (389-ds-base) | RHSA-2015:0416 | 2015-03-05 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 6 | 389-ds-base | Not affected |