CVE-2014-8112

389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:N/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
VendorProductVersion
fedoraproject389_directory_server
1.3.1.0
fedoraproject389_directory_server
1.3.1.1
fedoraproject389_directory_server
1.3.1.2
fedoraproject389_directory_server
1.3.1.3
fedoraproject389_directory_server
1.3.1.4
fedoraproject389_directory_server
1.3.1.5
fedoraproject389_directory_server
1.3.1.6
fedoraproject389_directory_server
1.3.1.7
fedoraproject389_directory_server
1.3.1.8
fedoraproject389_directory_server
1.3.1.9
fedoraproject389_directory_server
1.3.1.10
fedoraproject389_directory_server
1.3.1.11
fedoraproject389_directory_server
1.3.1.12
fedoraproject389_directory_server
1.3.1.13
fedoraproject389_directory_server
1.3.1.14
fedoraproject389_directory_server
1.3.1.15
fedoraproject389_directory_server
1.3.1.16
fedoraproject389_directory_server
1.3.1.17
fedoraproject389_directory_server
1.3.1.18
fedoraproject389_directory_server
1.3.1.19
fedoraproject389_directory_server
1.3.1.22
fedoraproject389_directory_server
1.3.2.2
fedoraproject389_directory_server
1.3.2.3
fedoraproject389_directory_server
1.3.2.4
fedoraproject389_directory_server
1.3.2.5
fedoraproject389_directory_server
1.3.2.6
fedoraproject389_directory_server
1.3.2.7
fedoraproject389_directory_server
1.3.2.8
fedoraproject389_directory_server
1.3.2.9
fedoraproject389_directory_server
1.3.2.10
fedoraproject389_directory_server
1.3.2.11
fedoraproject389_directory_server
1.3.2.13
fedoraproject389_directory_server
1.3.2.16
fedoraproject389_directory_server
1.3.2.19
fedoraproject389_directory_server
1.3.2.22
fedoraproject389_directory_server
1.3.2.23
fedoraproject389_directory_server
1.3.2.24
fedoraproject389_directory_server
1.3.2.26
fedoraproject389_directory_server
1.3.3.0
fedoraproject389_directory_server
1.3.3.2
fedoraproject389_directory_server
1.3.3.3
fedoraproject389_directory_server
1.3.3.5
fedoraproject389_directory_server
1.3.3.8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
389-ds-base
bullseye
1.4.4.11-2
fixed
bookworm
2.3.1+dfsg1-1
fixed
sid
3.1.1+dfsg1-2
fixed
trixie
3.1.1+dfsg1-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
389-ds-base
disco
not-affected
cosmic
not-affected
bionic
not-affected
artful
not-affected
zesty
not-affected
yakkety
not-affected
xenial
not-affected
wily
ignored
vivid
ignored
utopic
ignored
trusty
dne
precise
not-affected
lucid
dne
Common Weakness Enumeration
References
http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-2-27.html
http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-9.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153991.html
http://rhn.redhat.com/errata/RHSA-2015-0416.html
https://bugzilla.redhat.com/show_bug.cgi?id=1172729
http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-2-27.html
http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-9.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153991.html
http://rhn.redhat.com/errata/RHSA-2015-0416.html
https://bugzilla.redhat.com/show_bug.cgi?id=1172729