389 Directory Server 1.3.1.x 1.3.2.x before 1.3.2.27 and 1.3.3.x before 1.3.3.9 stores \unhashed\ passwords even when the nsslapd-unhashed-pw-switch option is set to off which allows remote authenticated users to obtain sensitive information by reading the Changelog.