389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before
8.2.10-3), after the password for a LDAP user has been changed and before
the server has been reset, allows remote attackers to read the plaintext
password via the unhashed#user#password attribute.