Unscored severity · published Oct 29, 2015
CVE-2015-3230
389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to…
–
CVSS
2.6%
EPSS
No
On KEV
Description
389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
3D
389 Directory Server · Fedoraproject
through 1.3.3.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3230
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3230
Patch
http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-12.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168985.html
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1230996
fedorahosted.org
https://fedorahosted.org/389/ticket/48194
More from 389 Directory Server
9.8
CVE-2017-7551
389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts
8.1
CVE-2017-15135
It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process
7.5
CVE-2019-10171
It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5
7.5
CVE-2019-3883
In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads
7.5
CVE-2018-14648
A flaw was found in 389 Directory Server