CVE-2023-1055: Fedoraproject Fedora

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Affected products

• Fedoraproject Fedora: version 36 only; version 37 only; version 38 only
• Red Hat Directory Server: version 11.5 only; version 11.6 only; version 12.0 only; version 12.1 only

Published 2023-02-27. Last modified 2026-06-17.