CVE-2012-2678: 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for...

Security readout for executives and security teams

This issue could expose a user's plaintext LDAP password after that password is changed, until the directory server is reset. For organizations using affected 389 Directory Server or Red Hat Directory Server versions, the business risk is credential disclosure from a core identity system. Exposure is most likely in legacy deployments running 389 Directory Server before 1.2.11.6 or Red Hat Directory Server before 8.2.10-3. Risk depends on whether LDAP attributes are remotely reachable and whether vulnerable password-change behavior is present. Prioritize remediation for any affected identity servers because directory credentials can enable broader account compromise. The issue is old, but legacy identity infrastructure often persists and deserves targeted verification. Mitigation focus: Upgrade 389 Directory Server to 1.2.11.6 or later.; Upgrade Red Hat Directory Server to 8.2.10-3 or later.; Apply the relevant Red Hat security advisories for affected systems..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.