CVE-2012-2668

libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive information.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
Affected Products (NVD)
VendorProductVersion
openldapopenldap
𝑥
≤ 2.4.31
openldapopenldap
2.4.6
openldapopenldap
2.4.7
openldapopenldap
2.4.8
openldapopenldap
2.4.9
openldapopenldap
2.4.10
openldapopenldap
2.4.11
openldapopenldap
2.4.12
openldapopenldap
2.4.13
openldapopenldap
2.4.14
openldapopenldap
2.4.15
openldapopenldap
2.4.16
openldapopenldap
2.4.17
openldapopenldap
2.4.18
openldapopenldap
2.4.19
openldapopenldap
2.4.20
openldapopenldap
2.4.21
openldapopenldap
2.4.22
openldapopenldap
2.4.23
openldapopenldap
2.4.24
openldapopenldap
2.4.25
openldapopenldap
2.4.26
openldapopenldap
2.4.27
openldapopenldap
2.4.28
openldapopenldap
2.4.29
openldapopenldap
2.4.30
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openldap
bookworm
2.5.13+dfsg-5
fixed
bullseye
2.4.57+dfsg-3+deb11u1
fixed
bullseye (security)
2.4.57+dfsg-3+deb11u1
fixed
sid
2.5.18+dfsg-3
fixed
trixie
2.5.18+dfsg-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
openldap
hardy
dne
lucid
not-affected
natty
not-affected
oneiric
not-affected
precise
not-affected
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
openldap
RHEL 6
0:2.4.23-26.el6_3.2
fixed
openldap-clients
RHEL 6
0:2.4.23-26.el6_3.2
fixed
openldap-devel
RHEL 6
0:2.4.23-26.el6_3.2
fixed
openldap-servers
RHEL 6
0:2.4.23-26.el6_3.2
fixed
openldap-servers-sql
RHEL 6
0:2.4.23-26.el6_3.2
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
openldap
Amazon Linux 1
0:2.4.23-26.16.amzn1
fixed
openldap-clients
Amazon Linux 1
0:2.4.23-26.16.amzn1
fixed
openldap-debuginfo
Amazon Linux 1
0:2.4.23-26.16.amzn1
fixed
openldap-devel
Amazon Linux 1
0:2.4.23-26.16.amzn1
fixed
openldap-servers
Amazon Linux 1
0:2.4.23-26.16.amzn1
fixed
openldap-servers-sql
Amazon Linux 1
0:2.4.23-26.16.amzn1
fixed
Common Weakness Enumeration
References
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=676309
http://rhn.redhat.com/errata/RHSA-2012-1151.html
http://seclists.org/fulldisclosure/2019/Dec/26
http://security.gentoo.org/glsa/glsa-201406-36.xml
http://www.openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commitdiff%3Bh=2c2bb2e
http://www.openldap.org/its/index.cgi?findid=7285
http://www.openwall.com/lists/oss-security/2012/06/05/4
http://www.openwall.com/lists/oss-security/2012/06/06/1
http://www.openwall.com/lists/oss-security/2012/06/06/2
http://www.securityfocus.com/bid/53823
http://www.securitytracker.com/id?1027127
https://bugzilla.redhat.com/show_bug.cgi?id=825875
https://exchange.xforce.ibmcloud.com/vulnerabilities/76099
https://seclists.org/bugtraq/2019/Dec/23
https://support.apple.com/kb/HT210788
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=676309
http://rhn.redhat.com/errata/RHSA-2012-1151.html
http://seclists.org/fulldisclosure/2019/Dec/26
http://security.gentoo.org/glsa/glsa-201406-36.xml
http://www.openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commitdiff%3Bh=2c2bb2e
http://www.openldap.org/its/index.cgi?findid=7285
http://www.openwall.com/lists/oss-security/2012/06/05/4
http://www.openwall.com/lists/oss-security/2012/06/06/1
http://www.openwall.com/lists/oss-security/2012/06/06/2
http://www.securityfocus.com/bid/53823
http://www.securitytracker.com/id?1027127
https://bugzilla.redhat.com/show_bug.cgi?id=825875
https://exchange.xforce.ibmcloud.com/vulnerabilities/76099
https://seclists.org/bugtraq/2019/Dec/23
https://support.apple.com/kb/HT210788