CVE-2018-10871 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2018-10871 Interim 1 28 2025-11-05T03:30:52Z current 2021-05-30T14:12:58Z 2025-11-05T03:30:52Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2018-10871 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2019-August/005817.html E-Mail link for SUSE-SU-2019:2155-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Liberty Linux 8 SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 openSUSE Tumbleweed 389-ds-1.4.0.26~git0.8a2d3de6f-4.14.1 389-ds-1.4.3.9~git0.3eb8617f6-1.2 389-ds-1.4.4.14~git0.37dc95673-1.1 389-ds-2.0.10~git0.21dd2802c-1.1 389-ds-2.0.15~git17.498ec3e93-150400.1.3 389-ds-2.5.3~git85.613c0979-150700.1.8 389-ds-3.0.6~git86.dce421a0d-160000.2.2 389-ds-base-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f 389-ds-base-devel-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f 389-ds-base-legacy-tools-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f 389-ds-base-libs-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f 389-ds-base-snmp-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f 389-ds-devel-1.4.0.26~git0.8a2d3de6f-4.14.1 389-ds-devel-1.4.3.9~git0.3eb8617f6-1.2 389-ds-devel-1.4.4.14~git0.37dc95673-1.1 389-ds-devel-2.0.10~git0.21dd2802c-1.1 389-ds-devel-2.0.15~git17.498ec3e93-150400.1.3 389-ds-devel-2.5.3~git85.613c0979-150700.1.8 389-ds-devel-3.0.6~git86.dce421a0d-160000.2.2 389-ds-snmp-2.0.10~git0.21dd2802c-1.1 389-ds-snmp-3.0.6~git86.dce421a0d-160000.2.2 lib389-1.4.3.9~git0.3eb8617f6-1.2 lib389-1.4.4.14~git0.37dc95673-1.1 lib389-2.0.10~git0.21dd2802c-1.1 lib389-2.0.15~git17.498ec3e93-150400.1.3 lib389-2.5.3~git85.613c0979-150700.1.8 lib389-3.0.6~git86.dce421a0d-160000.2.2 libsvrcore0-1.4.3.9~git0.3eb8617f6-1.2 libsvrcore0-1.4.4.14~git0.37dc95673-1.1 libsvrcore0-2.0.10~git0.21dd2802c-1.1 libsvrcore0-2.0.15~git17.498ec3e93-150400.1.3 libsvrcore0-2.5.3~git85.613c0979-150700.1.8 libsvrcore0-3.0.6~git86.dce421a0d-160000.2.2 python3-lib389-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f 389-ds-base-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f as a component of SUSE Liberty Linux 8 389-ds-base-devel-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f as a component of SUSE Liberty Linux 8 389-ds-base-legacy-tools-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f as a component of SUSE Liberty Linux 8 389-ds-base-libs-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f as a component of SUSE Liberty Linux 8 389-ds-base-snmp-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f as a component of SUSE Liberty Linux 8 python3-lib389-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f as a component of SUSE Liberty Linux 8 389-ds-1.4.0.26~git0.8a2d3de6f-4.14.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 389-ds-devel-1.4.0.26~git0.8a2d3de6f-4.14.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 389-ds-1.4.0.26~git0.8a2d3de6f-4.14.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 389-ds-devel-1.4.0.26~git0.8a2d3de6f-4.14.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 389-ds-1.4.3.9~git0.3eb8617f6-1.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 389-ds-devel-1.4.3.9~git0.3eb8617f6-1.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 lib389-1.4.3.9~git0.3eb8617f6-1.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libsvrcore0-1.4.3.9~git0.3eb8617f6-1.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 389-ds-1.4.4.14~git0.37dc95673-1.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 389-ds-devel-1.4.4.14~git0.37dc95673-1.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 lib389-1.4.4.14~git0.37dc95673-1.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 libsvrcore0-1.4.4.14~git0.37dc95673-1.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 389-ds-2.0.15~git17.498ec3e93-150400.1.3 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 389-ds-devel-2.0.15~git17.498ec3e93-150400.1.3 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 lib389-2.0.15~git17.498ec3e93-150400.1.3 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 libsvrcore0-2.0.15~git17.498ec3e93-150400.1.3 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 389-ds-2.5.3~git85.613c0979-150700.1.8 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 389-ds-devel-2.5.3~git85.613c0979-150700.1.8 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 lib389-2.5.3~git85.613c0979-150700.1.8 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 libsvrcore0-2.5.3~git85.613c0979-150700.1.8 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 389-ds-3.0.6~git86.dce421a0d-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 389-ds-devel-3.0.6~git86.dce421a0d-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 389-ds-snmp-3.0.6~git86.dce421a0d-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 lib389-3.0.6~git86.dce421a0d-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 libsvrcore0-3.0.6~git86.dce421a0d-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 389-ds-2.0.10~git0.21dd2802c-1.1 as a component of openSUSE Tumbleweed 389-ds-devel-2.0.10~git0.21dd2802c-1.1 as a component of openSUSE Tumbleweed 389-ds-snmp-2.0.10~git0.21dd2802c-1.1 as a component of openSUSE Tumbleweed lib389-2.0.10~git0.21dd2802c-1.1 as a component of openSUSE Tumbleweed libsvrcore0-2.0.10~git0.21dd2802c-1.1 as a component of openSUSE Tumbleweed 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords. CVE-2018-10871 SUSE Liberty Linux 8:389-ds-base-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f SUSE Liberty Linux 8:389-ds-base-devel-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f SUSE Liberty Linux 8:389-ds-base-legacy-tools-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f SUSE Liberty Linux 8:389-ds-base-libs-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f SUSE Liberty Linux 8:389-ds-base-snmp-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f SUSE Liberty Linux 8:python3-lib389-1.4.1.3-7.module+el8.1.0+4150+5b8c2c1f SUSE Linux Enterprise Module for Server Applications 15:389-ds-1.4.0.26~git0.8a2d3de6f-4.14.1 SUSE Linux Enterprise Module for Server Applications 15:389-ds-devel-1.4.0.26~git0.8a2d3de6f-4.14.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:389-ds-1.4.0.26~git0.8a2d3de6f-4.14.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:389-ds-devel-1.4.0.26~git0.8a2d3de6f-4.14.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:389-ds-1.4.3.9~git0.3eb8617f6-1.2 SUSE Linux Enterprise Module for Server Applications 15 SP2:389-ds-devel-1.4.3.9~git0.3eb8617f6-1.2 SUSE Linux Enterprise Module for Server Applications 15 SP2:lib389-1.4.3.9~git0.3eb8617f6-1.2 SUSE Linux Enterprise Module for Server Applications 15 SP2:libsvrcore0-1.4.3.9~git0.3eb8617f6-1.2 SUSE Linux Enterprise Module for Server Applications 15 SP3:389-ds-1.4.4.14~git0.37dc95673-1.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:389-ds-devel-1.4.4.14~git0.37dc95673-1.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:lib389-1.4.4.14~git0.37dc95673-1.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:libsvrcore0-1.4.4.14~git0.37dc95673-1.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:389-ds-2.0.15~git17.498ec3e93-150400.1.3 SUSE Linux Enterprise Module for Server Applications 15 SP4:389-ds-devel-2.0.15~git17.498ec3e93-150400.1.3 SUSE Linux Enterprise Module for Server Applications 15 SP4:lib389-2.0.15~git17.498ec3e93-150400.1.3 SUSE Linux Enterprise Module for Server Applications 15 SP4:libsvrcore0-2.0.15~git17.498ec3e93-150400.1.3 SUSE Linux Enterprise Module for Server Applications 15 SP7:389-ds-2.5.3~git85.613c0979-150700.1.8 SUSE Linux Enterprise Module for Server Applications 15 SP7:389-ds-devel-2.5.3~git85.613c0979-150700.1.8 SUSE Linux Enterprise Module for Server Applications 15 SP7:lib389-2.5.3~git85.613c0979-150700.1.8 SUSE Linux Enterprise Module for Server Applications 15 SP7:libsvrcore0-2.5.3~git85.613c0979-150700.1.8 SUSE Linux Enterprise Server 16.0:389-ds-3.0.6~git86.dce421a0d-160000.2.2 SUSE Linux Enterprise Server 16.0:389-ds-devel-3.0.6~git86.dce421a0d-160000.2.2 SUSE Linux Enterprise Server 16.0:389-ds-snmp-3.0.6~git86.dce421a0d-160000.2.2 SUSE Linux Enterprise Server 16.0:lib389-3.0.6~git86.dce421a0d-160000.2.2 SUSE Linux Enterprise Server 16.0:libsvrcore0-3.0.6~git86.dce421a0d-160000.2.2 openSUSE Tumbleweed:389-ds-2.0.10~git0.21dd2802c-1.1 openSUSE Tumbleweed:389-ds-devel-2.0.10~git0.21dd2802c-1.1 openSUSE Tumbleweed:389-ds-snmp-2.0.10~git0.21dd2802c-1.1 openSUSE Tumbleweed:lib389-2.0.10~git0.21dd2802c-1.1 openSUSE Tumbleweed:libsvrcore0-2.0.10~git0.21dd2802c-1.1 moderate 4 AV:N/AC:L/Au:S/C:P/I:N/A:N 3.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N