CVE-2019-10224: Infoleak
First published: Thu Feb 14 2019(Updated: )
A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/389-ds-base | <1.4.1.3 | 1.4.1.3 |
| Fedoraproject 389 Directory Server | >=1.4.0.0<1.4.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224
- https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
- https://pagure.io/389-ds-base/issue/50251
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1654059
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1677148
- https://pagure.io/389-ds-base/c/632ecb90d96ac0535656f5aaf67fd2be4b81d310
- https://access.redhat.com/errata/RHSA-2019:3401
- https://access.redhat.com/security/cve/cve-2019-10224
- https://bugzilla.redhat.com/show_bug.cgi?id=1677147
Frequently Asked Questions
What is CVE-2019-10224?
CVE-2019-10224 is a vulnerability found in 389-ds-base versions 1.4.x.x before 1.4.1.3, which may display sensitive information in verbose mode.
How severe is CVE-2019-10224?
CVE-2019-10224 has a severity rating of 4.6 (medium).
How can an attacker exploit CVE-2019-10224?
An attacker who can see the screen or record the terminal standard error output could exploit CVE-2019-10224 to gain sensitive information.
What is the affected software?
The affected software is 389-ds-base versions 1.4.x.x before 1.4.1.3, as well as FedoraProject 389 Directory Server versions between 1.4.0.0 and 1.4.1.3.
How can I fix CVE-2019-10224?
To fix CVE-2019-10224, update your 389-ds-base package to version 1.4.1.3 or later.
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-10224
- agent/software-canonical-lookup
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/fedoraproject
- canonical/fedoraproject 389 directory server
- version/fedoraproject 389 directory server/1.4.0.0
- package-manager/redhat