CVE-2014-8112
389-ds-base: password hashing bypassed when "nsslapd-unhashed-pw-switch" is set to off
Severity
LowRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · March 5, 2015
Updated · November 21, 2025
Description
It was found that when the nsslapd-unhashed-pw-switch 389 Directory Server configuration option was set to "off", it did not prevent the writing of unhashed passwords into the Changelog. This could potentially allow an authenticated user able to access the Changelog to read sensitive information.
Statement
This issue did not affect the versions of 389-ds-base as shipped with Red Hat Enterprise Linux 6.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 1.4AV:A/AC:H/Au:S/C:P/I:N/A:N
CWE-522 · Insufficiently Protected Credentials