NVD

Id
44386  
Name
CVE-2012-2668  
Description
libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive information.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2012-06-16  
Modified Date
2017-01-06  
Seq
2012-2668  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
222647 44386 CVE-2012-2668 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=676309  View
222648 44386 CVE-2012-2668 RHSA-2012:1151  View
222649 44386 CVE-2012-2668 GLSA-201406-36  View
222650 44386 CVE-2012-2668 http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=2c2bb2e  View
222651 44386 CVE-2012-2668 http://www.openldap.org/its/index.cgi?findid=7285  View
222652 44386 CVE-2012-2668 [oss-security] 20120605 CVE request: openldap does not honor TLSCipherSuite configuration option  View
222653 44386 CVE-2012-2668 [oss-security] 20120605 Re: CVE request: openldap does not honor TLSCipherSuite configuration option  View
222654 44386 CVE-2012-2668 [oss-security] 20120606 Re: CVE request: openldap does not honor TLSCipherSuite configuration option  View
222655 44386 CVE-2012-2668 53823  View
222656 44386 CVE-2012-2668 1027127  View
222657 44386 CVE-2012-2668 openldap-nss-weak-security(76099)  View
222658 44386 CVE-2012-2668 https://bugzilla.redhat.com/show_bug.cgi?id=825875  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
27073 JVNDB-2012-002780 OpenLDAP の libraries/libldap/tls_m.c における重要な情報を取得される脆弱性 OpenLDAP の libraries/libldap/tls_m.c には、Mozilla の NSS をバックエンドで使用する場合、TLSCipherSuite が設定されていても、既定の暗号スイートを常に使用するため、OpenLDAP が想定するよりも弱い暗号が使用される可能性があり、重要な情報を取得される脆弱性が存在します。 CVE-2012-2668 55906 CVE-2012-2668 44386 4.3 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002780.html 2012-06-04 2012-09-14 View