Skip to content
Fencer Vulns
medium 5.5

CVE-2023-1055 json

A flaw was found in RHDS 11 and RHDS 12.

published 2023-02-27 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-23346

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Patch / fix

  • 389-ds-base Debian 13 2.3.4+dfsg1-1

debian advisories DEBIAN-CVE-2023-1055

  • 389-ds-base directory server 12.1 2.1.8-1.module+el9dsrv+18377+a10e6f72
  • cockpit-389-ds directory server 12.1 2.1.8-1.module+el9dsrv+18377+a10e6f72
  • python3-lib389 directory server 12.1 2.1.8-1.module+el9dsrv+18377+a10e6f72
  • 389-ds-base-libs directory server 12.1 2.1.8-1.module+el9dsrv+18377+a10e6f72
  • 389-ds-base-snmp directory server 12.1 2.1.8-1.module+el9dsrv+18377+a10e6f72
  • 389-ds-base directory server 11.6 1.4.3.34-1.module+el8dsrv+18380+8350b80e
  • cockpit-389-ds directory server 11.6 1.4.3.34-1.module+el8dsrv+18380+8350b80e
  • python3-lib389 directory server 11.6 1.4.3.34-1.module+el8dsrv+18380+8350b80e

red hat advisories RHSA-2023:3489RHSA-2023:4655

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-1055 updated cvss 5.5

RHDS: LDAP browser tries to decode userPassword instead of userCertificate attribute

  • Red Hat Directory Server 11.6 for RHEL 8 389-ds-base 1.4.3.34-1.module+el8dsrv+18380+8350b80e, cockpit-389-ds 1.4.3.34-1.module+el8dsrv+18380+8350b80e, python3-lib389 1.4.3.34-1.module+el8dsrv+18380+8350b80e, 389-ds-base-libs 1.4.3.34-1.module+el8dsrv+18380+8350b80e, 389-ds-base-snmp 1.4.3.34-1.module+el8dsrv+18380+8350b80e, 389-ds-base-legacy-tools 1.4.3.34-1.module+el8dsrv+18380+8350b80e
    fixed: vendor fix RHSA-2023:4655
  • Red Hat Directory Server 12.1 for RHEL 9 389-ds-base 2.1.8-1.module+el9dsrv+18377+a10e6f72, cockpit-389-ds 2.1.8-1.module+el9dsrv+18377+a10e6f72, python3-lib389 2.1.8-1.module+el9dsrv+18377+a10e6f72, 389-ds-base-libs 2.1.8-1.module+el9dsrv+18377+a10e6f72, 389-ds-base-snmp 2.1.8-1.module+el9dsrv+18377+a10e6f72
    fixed: vendor fix RHSA-2023:3489
  • Red Hat Enterprise Linux 6 389-ds-base, 389-ds-base-libs Red Hat Enterprise Linux 7 389-ds-base, 389-ds-base-libs, 389-ds-base-snmp Red Hat Enterprise Linux 8 389-ds-base, cockpit-389-ds, python3-lib389, 389-ds-base-libs, 389-ds-base-snmp, 389-ds-base-legacy-tools Red Hat Enterprise Linux 9 389-ds-base, python3-lib389, 389-ds-base-libs, 389-ds-base-snmp
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • n/a Red Hat Directory Server

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.