CVE-2023-1055

What it actually does

The flaw causes LDAP in RHDS to incorrectly decode the userPassword attribute instead of userCertificate during entry browsing, exposing password hashes to local users inspecting cockpit-389-ds processes.

Why it matters to the business

Local attackers on affected hosts can obtain directory server password hashes, enabling offline cracking and potential compromise of user accounts and authentication data with low exploitation probability indicated by stable low EPSS over 1327 days since 2023-02-27 publication.

How an attack unfolds

An attacker with a local account on a host running RHDS and cockpit-389-ds lists processes to identify the directory server, then observes or triggers LDAP entry browsing operations that leak hashed passwords due to the attribute decoding error.

How to fix it

Apply patches for Red Hat Directory Server 11 and 12 when released by the vendor; no fixed versions currently available. Restrict unnecessary local access and monitor official Red Hat/Fedora advisories for updates.

How to confirm the fix worked

Confirm that LDAP entry browsing no longer mishandles userPassword decoding; test by inspecting processes and verifying absence of password hash leakage in cockpit-389-ds output on updated systems.

Typical attack path

1. Gain local account access on the host running cockpit-389-ds
2. Enumerate processes to locate 389-ds instances
3. Trigger LDAP operations that browse entries
4. Extract exposed userPassword hashes from process inspection or memory

How to detect it

Examine system and process logs for activity involving cockpit-389-ds or 389-ds instances; look for evidence of local enumeration or LDAP attribute access that could expose password data.

What your security team should do

• Prioritize monitoring for RHDS patches given the local information disclosure risk
• Limit local user access to directory server hosts
• Disable cockpit-389-ds interface if not essential
• Review process monitoring and memory protections on affected systems