PT-2023-16722 · Red Hat+2 · Rhds+2

Borja Tarraso · Published 2023-02-27 · Updated 2023-08-02 · CVE-2023-1055

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions RHDS versions 11 through 12

Description A flaw was found in RHDS where LDAP tries to decode the userPassword attribute instead of the userCertificate attribute, potentially leading to sensitive information leakage. An attacker with a local account where the cockpit-389-ds is running can list processes and display hashed passwords, posing the highest threat to data confidentiality.

Recommendations For RHDS versions 11 and 12, consider restricting access to the cockpit-389-ds component and limiting the ability to list processes and display hashed passwords until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Improper Certificate Validation

Weakness Enumeration

CWE-200

CWE-295

Related Identifiers

BDU:2025-12486

CVE-2023-1055

RHSA-2023:3489

RHSA-2023:4655

Affected Products

Astra Linux

Debian

Rhds

References · 19

• https://osv.dev/vulnerability/DEBIAN-CVE-2023-1055 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1055 · Security Note
• https://bdu.fstec.ru/vul/2025-12486 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1055 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1055 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-1055 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2173517#c0 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1055 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-1055 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZOYQ5TCV6ZEPMDV4CSLK3KINAAO4SRI · Vendor Advisory
• https://github.com/389ds/389-ds-base/commit/92f9d3b9d06c1729e536948c638761c9fa7c962a · Note
• https://github.com/389ds/389-ds-base/commit/8483d60de374be78ce3dd423ac7ad7a3cdc5eaca · Note
• https://github.com/389ds/389-ds-base/commit/2038989d477d6281463668c91f72649fde880145 · Note