PT-2023-16722 · Red Hat+2 · Rhds+2

Borja Tarraso · Publicado 2023-02-27 · Atualizado 2023-08-02 · CVE-2023-1055

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions RHDS versions 11 through 12

Description A flaw was found in RHDS where LDAP tries to decode the userPassword attribute instead of the userCertificate attribute, potentially leading to sensitive information leakage. An attacker with a local account where the cockpit-389-ds is running can list processes and display hashed passwords, posing the highest threat to data confidentiality.

Recommendations For RHDS versions 11 and 12, consider restricting access to the cockpit-389-ds component and limiting the ability to list processes and display hashed passwords until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Improper Certificate Validation

Enumeração de Fraquezas

CWE-200

CWE-295

Identificadores relacionados

BDU:2025-12486

CVE-2023-1055

RHSA-2023:3489

RHSA-2023:4655

Produtos afetados

Astra Linux

Debian

Rhds

Referências · 19

• https://github.com/389ds/389-ds-base/commit/92f9d3b9d06c1729e536948c638761c9fa7c962a · Nota
• https://github.com/389ds/389-ds-base/commit/8483d60de374be78ce3dd423ac7ad7a3cdc5eaca · Nota
• https://github.com/389ds/389-ds-base/commit/2038989d477d6281463668c91f72649fde880145 · Nota
• https://t.me/cibsecurity/59076 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-1055 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-1055 · Nota de Segurança
• https://bdu.fstec.ru/vul/2025-12486 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-1055 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-1055 · Aviso do Fabricante
• https://t.me/cvenotify/45797 · Publicação no Telegram
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-1055 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=2173517#c0 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1055 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-1055 · Nota de Segurança