Every CVE Search/ Get API key

CVE-2023-1055

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the...

5.5 MediumFix available

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.19%Down 0.7 points since Feb 28, 2023
90%50%10%1%

What each source reports

NVD Score used 5.5

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Record
CVE-2023-1055
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-295
Updated
2026-11-02
CVE List No score

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Record
CVE-2023-1055
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2023-23346 0.0

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Record
EUVD-2023-23346
CVSS
0.0 NoneCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-w8wv-xqxw-7vgx 5.5

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the...

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Record
GHSA-w8wv-xqxw-7vgx
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-295
Updated
2026-11-02
OSV 5.5

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Record
CVE-2023-1055
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2023-1055 5.5

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Record
DEBIAN-CVE-2023-1055
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2023:3489 5.5

Red Hat Security Advisory: redhat-ds:12 security, bug fix, and enhancement update

Record
RHSA-2023:3489
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2023:4655 5.5

Red Hat Security Advisory: redhat-ds:11 security, bug fix, and enhancement update

Record
RHSA-2023:4655
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2023-1055 5.5

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Record
UBUNTU-CVE-2023-1055
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
389-ds-base
Debian:12
 All versions, plus listed versions
2.3.1+dfsg1-12.3.1+dfsg1-1+deb12u12.3.4+dfsg1-12.3.4+dfsg1-1.12.4.4+dfsg1-1
Show 13 moreShow less
2.4.4+dfsg1-32.4.5+dfsg1-13.0.2+dfsg1-13.1.1+dfsg1-13.1.1+dfsg1-23.1.1+dfsg1-33.1.2+dfsg1-13.1.2+vendor1-13.1.2+vendor1-23.3.0-13.3.0-23.3.1-13.3.1-3
 None known
389-ds-base
Debian:13
 before 2.3.4+dfsg1-1
2.3.4+dfsg1-1
389-ds-base
Red Hat:directory_server:12.1::el9
 before 0:2.1.8-1.module+el9dsrv+18377+a10e6f72
0:2.1.8-1.module+el9dsrv+18377+a10e6f72
389-ds-base-debuginfo
Red Hat:directory_server:12.1::el9
 before 0:2.1.8-1.module+el9dsrv+18377+a10e6f72
0:2.1.8-1.module+el9dsrv+18377+a10e6f72
389-ds-base-debugsource
Red Hat:directory_server:12.1::el9
 before 0:2.1.8-1.module+el9dsrv+18377+a10e6f72
0:2.1.8-1.module+el9dsrv+18377+a10e6f72
389-ds-base-devel
Red Hat:directory_server:12.1::el9
 before 0:2.1.8-1.module+el9dsrv+18377+a10e6f72
0:2.1.8-1.module+el9dsrv+18377+a10e6f72
389-ds-base-libs
Red Hat:directory_server:12.1::el9
 before 0:2.1.8-1.module+el9dsrv+18377+a10e6f72
0:2.1.8-1.module+el9dsrv+18377+a10e6f72
389-ds-base-libs-debuginfo
Red Hat:directory_server:12.1::el9
 before 0:2.1.8-1.module+el9dsrv+18377+a10e6f72
0:2.1.8-1.module+el9dsrv+18377+a10e6f72
389-ds-base-snmp
Red Hat:directory_server:12.1::el9
 before 0:2.1.8-1.module+el9dsrv+18377+a10e6f72
0:2.1.8-1.module+el9dsrv+18377+a10e6f72
389-ds-base-snmp-debuginfo
Red Hat:directory_server:12.1::el9
 before 0:2.1.8-1.module+el9dsrv+18377+a10e6f72
0:2.1.8-1.module+el9dsrv+18377+a10e6f72
Show 22 moreShow less
Affected packages
PackageAffectedFixed
cockpit-389-ds
Red Hat:directory_server:12.1::el9
 before 0:2.1.8-1.module+el9dsrv+18377+a10e6f72
0:2.1.8-1.module+el9dsrv+18377+a10e6f72
python3-lib389
Red Hat:directory_server:12.1::el9
 before 0:2.1.8-1.module+el9dsrv+18377+a10e6f72
0:2.1.8-1.module+el9dsrv+18377+a10e6f72
389-ds-base
Red Hat:directory_server:11.6::el8
 before 0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
389-ds-base-debuginfo
Red Hat:directory_server:11.6::el8
 before 0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
389-ds-base-debugsource
Red Hat:directory_server:11.6::el8
 before 0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
389-ds-base-devel
Red Hat:directory_server:11.6::el8
 before 0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
389-ds-base-legacy-tools
Red Hat:directory_server:11.6::el8
 before 0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
389-ds-base-legacy-tools-debuginfo
Red Hat:directory_server:11.6::el8
 before 0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
389-ds-base-libs
Red Hat:directory_server:11.6::el8
 before 0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
389-ds-base-libs-debuginfo
Red Hat:directory_server:11.6::el8
 before 0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
389-ds-base-snmp
Red Hat:directory_server:11.6::el8
 before 0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
389-ds-base-snmp-debuginfo
Red Hat:directory_server:11.6::el8
 before 0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
cockpit-389-ds
Red Hat:directory_server:11.6::el8
 before 0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
python3-lib389
Red Hat:directory_server:11.6::el8
 before 0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
0:1.4.3.34-1.module+el8dsrv+18380+8350b80e
389-ds-base
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.3.3.12-1build11.3.3.13-11.3.4.5-21.3.4.8-11.3.4.8-3
Show 4 moreShow less
1.3.4.8-3ubuntu11.3.4.8-41.3.4.9-11.3.4.9-1ubuntu0.1~esm1
 None known
389-ds-base
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.3.7.5-11.3.7.5-1build11.3.7.5-1build21.3.7.9-11.3.7.10-11.3.7.10-1ubuntu11.3.7.10-1ubuntu1+esm1
 None known
389-ds-base
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.4.1.6-41.4.1.6-4build11.4.2.4-11.4.2.4-1build11.4.3.2-11.4.3.2-1build11.4.3.6-21.4.3.6-2ubuntu0.1~esm1
 None known
389-ds-base
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.4.4.11-2build11.4.4.11-2build21.4.4.17-12.0.11-22.0.14-12.0.15-12.0.15-1ubuntu2
 None known
389-ds-base
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.3.4+dfsg1-12.4.4+dfsg1-1ubuntu12.4.4+dfsg1-1ubuntu42.4.4+dfsg1-32.4.5+dfsg1-1
 None known
389-ds-base
Ubuntu:25.10
 All versions, plus listed versions
3.1.2+dfsg1-1
 None known
389-ds-base
Ubuntu:26.10
 All versions, plus listed versions
3.1.2+vendor1-23.1.2+vendor1-2build13.3.1-3
 None known
389-ds-base
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.1.2+dfsg1-13.1.2+vendor1-2
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-1055 is a medium vulnerability (CVSS 5.5) in Fedoraproject Fedora, published February 27, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in 389-ds-base 2.3.4+dfsg1-1.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open