CVE-2018-10871
Fixed in a distro release EPSS 1%CVSS 3.8
389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.
Products: fedoraproject 389_directory_server, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | 389-ds-base | 1.4.0.15-1 |
| Debian 13 | 389-ds-base | 1.4.0.15-1 |
| Debian 8 | 389-ds-base | 1.3.3.5-4+deb8u2 |
| Red Hat Enterprise Linux 8 | 389-ds-base | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-debuginfo | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-debugsource | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-devel | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-legacy-tools | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-legacy-tools-debuginfo | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-libs | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-libs-debuginfo | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-snmp | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | 389-ds-base-snmp-debuginfo | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| Red Hat Enterprise Linux 8 | python3-lib389 | 0:1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f |
| SUSE Linux Enterprise Module for Server Applications 15 | 389-ds | 1.4.0.26~git0.8a2d3de6f-4.14.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP1 | 389-ds | 1.4.0.26~git0.8a2d3de6f-4.14.1 |
| Ubuntu 26.04 LTS | 389-ds-base | no fix |
| Ubuntu Pro 16.04 LTS | 389-ds-base | no fix |
| Ubuntu Pro 18.04 LTS | 389-ds-base | no fix |
| openSUSE Tumbleweed | 389-ds | 2.0.10~git0.21dd2802c-1.1 |