CVE-2014-8112: 389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwor...

Security readout for executives and security teams

Some older 389 Directory Server versions could retain unhashed passwords in the changelog even when configured not to. An authenticated remote user with changelog read access could obtain sensitive password data. This is most urgent for legacy directory services that still run the listed 1.3.x versions. Exposure is likely limited to legacy 389 Directory Server deployments, especially environments retaining 1.3.x packages or old Red Hat/Fedora builds with changelog access enabled for authenticated users. Prioritize legacy identity infrastructure review. Treat confirmed exposure as high business risk because directory password disclosure can enable broader account compromise, even without evidence of public exploitation in the provided sources. Mitigation focus: Upgrade 389 Directory Server to a fixed vendor-supported version.; Apply RHSA-2015:0416 or relevant Fedora/vendor package updates where applicable.; Restrict changelog access to only required administrative identities..

Prepared

Jun 13, 2026, 22:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.