Description
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | 389-ds-base +2 | 1.2.10.2-18.el6_3 | RHSA-2012:0997 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Directory Server 8 | redhat-ds-base +1 | 8.2.10-3.el5dsrv | RHSA-2012:1041 |
Advisories 2
- RHSA-2012:0997 Red Hat Security Advisory: 389-ds-base security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:1041 Red Hat Security Advisory: redhat-ds-base security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 83329 vdb-entry
- https://fedorahosted.org/389/ticket/365
- 49734 third-party-advisory
- 389directory-logging-info-disclosure(76595) vdb-entry
- SSRT101189 vendor-advisory
- 54153 vdb-entry
- http://directory.fedoraproject.org/wiki/Release_Notes
- RHSA-2012:1041 vendor-advisory
- RHSA-2012:0997 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=833482
- oval:org.mitre.oval:def:19241 vdb-entry signature