REDHAT-BUG-1172729: Low severity red hat 389 directory server vulnerability
Ludwig Krispenz from Red Hat reported that there is a configuration switch to prevent writing unhashed passwords into the changelogs. Unfortunately if the switch is turned on the attribute unhashed#user#password is not written to the changelog, but the hashing of the attribute value itself is also bypassed.
Versions affected are 389 versions 1.3.1 and later, this means RHEL7.0 and later and Fedora20 and later.
The severity seems to be limited, since: - the option is not widely known and advertised and only available in a recent version - the access to the userpassword attribute is usually protected by acis not to be readable
Statement:
This issue did not affect the versions of 389-ds-base as shipped with Red Hat Enterprise Linux 6.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1172729?
The severity of REDHAT-BUG-1172729 is categorized as moderate.
How do I fix REDHAT-BUG-1172729?
To fix REDHAT-BUG-1172729, ensure that the configuration switch for writing unhashed passwords in changelogs is set appropriately.
Which versions of Red Hat 389 are affected by REDHAT-BUG-1172729?
REDHAT-BUG-1172729 affects Red Hat 389 versions from 1.3.1 onward.
What is the impact of REDHAT-BUG-1172729 on password security?
The impact of REDHAT-BUG-1172729 is that it may lead to unhashed passwords being exposed if the configuration switch is misconfigured.
Is Red Hat Directory Server impacted by REDHAT-BUG-1172729?
Yes, Red Hat Directory Server versions prior to 6 are impacted by REDHAT-BUG-1172729.