CVE-2018-10871
Published: 18 July 2018
389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
389-ds-base Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
| bionic |
Needed
|
|
| cosmic |
Ignored
(end of life)
|
|
| disco |
Not vulnerable
(1.4.0.13-1)
|
|
| eoan |
Not vulnerable
(1.4.0.13-1)
|
|
| focal |
Not vulnerable
(1.4.0.13-1)
|
|
| groovy |
Not vulnerable
(1.4.0.13-1)
|
|
| hirsute |
Not vulnerable
(1.4.0.13-1)
|
|
| impish |
Not vulnerable
(1.4.0.13-1)
|
|
| jammy |
Not vulnerable
(1.4.0.13-1)
|
|
| kinetic |
Not vulnerable
(1.4.0.13-1)
|
|
| lunar |
Not vulnerable
(1.4.0.13-1)
|
|
| mantic |
Not vulnerable
(1.4.0.13-1)
|
|
| trusty |
Does not exist
(trusty was needs-triage)
|
|
| upstream |
Released
(1.4.0.13-1)
|
|
| xenial |
Needed
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.2 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | High |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |