Description
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | 389-ds-base +2 | 1.2.10.2-18.el6_3 | RHSA-2012:0997 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Directory Server 8 | redhat-ds-base +1 | 8.2.10-3.el5dsrv | RHSA-2012:1041 |
Advisories 2
- RHSA-2012:0997 Red Hat Security Advisory: 389-ds-base security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:1041 Red Hat Security Advisory: redhat-ds-base security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- oval:org.mitre.oval:def:19353 vdb-entry signature
- 49734 third-party-advisory
- SSRT101189 vendor-advisory
- 83336 vdb-entry
- 54153 vdb-entry
- http://directory.fedoraproject.org/wiki/Release_Notes
- RHSA-2012:1041 vendor-advisory
- RHSA-2012:0997 vendor-advisory