SB2020021014 - Red Hat update for 389-ds:1.4
Published: February 10, 2020
Security Bulletin ID
SB2020021014
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Information disclosure (CVE-ID: CVE-2019-14824)
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to incorrect permissions in the 'deref' plugin in 389-ds-base when displaying attribute values during search. A remote user in local network can gain access to private attributes, such as password hashes.
Remediation
Install update from vendor's website.