CVEvulnerability

CVE-2012-2668

4.3 MEDIUM Published 2012-06-17 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-06-17
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive information.

Affected configurations

• openldap openldap (<= 2.4.31) • openldap openldap 2.4.6 • openldap openldap 2.4.7 • openldap openldap 2.4.8 • openldap openldap 2.4.9 • openldap openldap 2.4.10 • openldap openldap 2.4.11 • openldap openldap 2.4.12 • openldap openldap 2.4.13 • openldap openldap 2.4.14 • openldap openldap 2.4.15 • openldap openldap 2.4.16 • openldap openldap 2.4.17 • openldap openldap 2.4.18 • openldap openldap 2.4.19 • openldap openldap 2.4.20 • openldap openldap 2.4.21 • openldap openldap 2.4.22 • openldap openldap 2.4.23 • openldap openldap 2.4.24 • openldap openldap 2.4.25 • openldap openldap 2.4.26 • openldap openldap 2.4.27 • openldap openldap 2.4.28 • openldap openldap 2.4.29 • openldap openldap 2.4.30

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References