Unscored severity · published Jun 17, 2012
CVE-2012-2668
libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which…
–
CVSS
3.9%
EPSS
No
On KEV
Description
libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive information.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openldap · Openldap
through 2.4.31; 2.4.6; 2.4.7; 2.4.8; 2.4.9; 2.4.10; +20 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2668
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2668
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=676309
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-1151.html
seclists.org
http://seclists.org/fulldisclosure/2019/Dec/26
security.gentoo.org
http://security.gentoo.org/glsa/glsa-201406-36.xml
www.openldap.org
http://www.openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commitdiff%3Bh=2c2bb2e
www.openldap.org
http://www.openldap.org/its/index.cgi?findid=7285
More from Openldap
9.8
CVE-2022-29155
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query
9.8
CVE-2010-0211
The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a…
7.5
CVE-2023-2953
A vulnerability was found in openldap
7.5
CVE-2020-25710
A flaw was found in OpenLDAP in versions before 2.4.56
7.5
CVE-2020-25709
A flaw was found in OpenLDAP