CVE-2012-2668 — Sensitive Information Exposure in Openldap

CWE-200 — Sensitive Information Exposure7 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
0.6%
top 31.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
OpenldapApple Macos Catalina 10.15.2 Security Update 2019-002 Mojave Security Update 2019-007Debian Openldap
Timeline
PublishedJun 17
Latest updateMay 17

Description

libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive information.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶NVDopenldap/openldap2.4.31+25

🔴Vulnerability Details

1
GHSA
GHSA-g25q-m772-8jx8: libraries/libldap/tls_m↗2022-05-17
▶

📋Vendor Advisories

3
Apple
CVE-2012-2668: macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra↗2019-12-10
▶
Red Hat
openldap: does not honor TLSCipherSuite settings↗2012-06-04
▶
Debian
CVE-2012-2668: openldap - libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using t...↗2012
▶

💬Community

2
Bugzilla
CVE-2012-2668 CVE-2012-1164 openldap various flaws [fedora-all]↗2012-06-06
▶
Bugzilla
CVE-2012-2668 openldap: does not honor TLSCipherSuite settings↗2012-05-28
▶