PT-2012-1161 · Openldap+4 · Openldap+4
Vincent Danen
·
Published
2012-06-17
·
Updated
2023-02-13
·
CVE-2012-2668
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
OpenLDAP versions prior to 2.4.35
Gentoo Linux (affected versions not specified)
Description
The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotely, potentially allowing attackers to obtain sensitive information. The problem arises when using the Mozilla NSS backend in OpenLDAP, as it always uses the default cipher suite, even when TLSCipherSuite is set. This might cause OpenLDAP to use weaker ciphers than intended.
Recommendations
For OpenLDAP versions prior to 2.4.35, update to version 2.4.35 or later to resolve the issue.
As a temporary workaround, consider disabling the use of the Mozilla NSS backend until a patch is available.
Restrict access to sensitive information to minimize the risk of exploitation.
Fix
Information Disclosure
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Centos
Gentoo Linux
Nss
Openldap
Red Hat