CVE-2019-10224: Infoleak
A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.
Other sources
When dscreate is executed in verbose mode, it prints Directory Manager's password to stderr. The same happens with dsconf when I change the password.
Version-Release number of selected component (if applicable): 389-ds-base-1.4.0.19-2.
How reproducible: always
Steps to Reproduce: 1. dscreate -v interactive 2. dsconf -v localhost directorymanager passwordchange
Actual results:
dscreate -v interactive ... DEBUG: cn=config set REPLACE: ('nsslapd-rootpw', 'DirectoryManagerPassword')
dsconf -v localhost directorymanager passwordchange ... Enter new directory manager password : CONFIRM - Enter new directory manager password : DEBUG: cn=config set REPLACE: ('nsslapd-rootpw', 'newpassword')
Expected results: Actual value should not be printed in the debug logs. Python logging module supports filters that should be used to redact sensitive information from the logs
Reference:
https://bugzilla.redhat.com/showbug.cgi?id=1654059
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10224?
CVE-2019-10224 is a vulnerability found in 389-ds-base versions 1.4.x.x before 1.4.1.3, which may display sensitive information in verbose mode.
How severe is CVE-2019-10224?
CVE-2019-10224 has a severity rating of 4.6 (medium).
How can an attacker exploit CVE-2019-10224?
An attacker who can see the screen or record the terminal standard error output could exploit CVE-2019-10224 to gain sensitive information.
What is the affected software?
The affected software is 389-ds-base versions 1.4.x.x before 1.4.1.3, as well as FedoraProject 389 Directory Server versions between 1.4.0.0 and 1.4.1.3.
How can I fix CVE-2019-10224?
To fix CVE-2019-10224, update your 389-ds-base package to version 1.4.1.3 or later.