| Name | CVE-2012-2668 |
| Description | libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive information. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| openldap (PTS) | jessie, jessie (lts) | 2.4.40+dfsg-1+deb8u11 | fixed |
| stretch (security), stretch (lts), stretch | 2.4.44+dfsg-5+deb9u9 | fixed | |
| buster (security), buster, buster (lts) | 2.4.47+dfsg-3+deb10u7 | fixed | |
| bullseye (security), bullseye | 2.4.57+dfsg-3+deb11u1 | fixed | |
| bookworm | 2.5.13+dfsg-5 | fixed | |
| sid, trixie | 2.5.18+dfsg-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| openldap | source | (unstable) | (not affected) |
- openldap <not-affected> (OpenLDAP in Debian uses GNUTLS instead of Mozilla NSS)
https://bugzilla.redhat.com/show_bug.cgi?id=825875
http://www.openldap.org/its/index.cgi?findid=7285
http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=2c2bb2e