A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.
CVSS Details
- CVSS 3.1 Base Score: 4.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- CVSS 3.0 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade 389-ds-base | Jan 17, 2020 | Nov 25, 2019 |
| Centos_linux | — | Upgrade 389-ds-base-libsUpgrade python3-lib389Upgrade 389-ds-base-develUpgrade 389-ds-base-legacy-tools-debuginfoUpgrade 389-ds-base-snmpUpgrade 389-ds-base-libs-debuginfoUpgrade 389-ds-base-debuginfoUpgrade 389-ds-base-debugsourceUpgrade 389-ds-baseUpgrade 389-ds-base-snmp-debuginfoUpgrade 389-ds-base-legacy-tools | Nov 6, 2019 | Nov 5, 2019 |
| Debian | — | Upgrade 389-ds-base | Apr 25, 2023 | Nov 25, 2019 |
| Oracle_linux | — | Upgrade 389-ds-base-snmpUpgrade 389-ds-base-develUpgrade 389-ds-baseUpgrade 389-ds-base-legacy-toolsUpgrade 389-ds-base-libsUpgrade python3-lib389 | Jul 22, 2024 | Nov 27, 2018 |
| Redhat_linux | — | Upgrade 389-ds-base-develUpgrade 389-ds-base-libsUpgrade 389-ds-base-legacy-toolsUpgrade 389-ds-base-legacy-tools-debuginfoUpgrade 389-ds-base-snmp-debuginfoUpgrade 389-ds-base-libs-debuginfoUpgrade 389-ds-baseUpgrade 389-ds-base-debugsourceUpgrade 389-ds-base-debuginfoUpgrade 389-ds-base-snmpUpgrade python3-lib389 | Nov 6, 2019 | Nov 5, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Nov 25, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub