REDHAT-BUG-825875
First published: Mon May 28 2012(Updated: )
It was reported that OpenLDAP, when using the Mozilla NSS backend, would ignore any TLSCipherSuite configuration settings. When the TLSCipherSuite setting is configured, OpenLDAP would use the default cipher suite, ignoring the setting. While the default cipher suite contains some weak ciphers (e.g. MD5-based), it is still not easy to break the encryption to obtain sensitive information. However, if an administrator wishes to enforce the use of stronger ciphers by overriding the defaults using TLSCipherSuite, they should be able to trust that, when the configuration items is in place, the stronger ciphers are used. Due to this flaw, that is not the case.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenLDAP |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openldap.org/its/index.cgi?findid=7285
- http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=2c2bb2e
- http://www.openwall.com/lists/oss-security/2012/06/06/1
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=676309
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=829481
- https://rhn.redhat.com/errata/RHSA-2012-1151.html
- https://bugzilla.redhat.com/show_bug.cgi?id=825875
Frequently Asked Questions
What is the severity of REDHAT-BUG-825875?
The severity of REDHAT-BUG-825875 is considered high due to the use of weak default ciphers.
How do I fix REDHAT-BUG-825875?
To fix REDHAT-BUG-825875, update your OpenLDAP configuration to explicitly set the TLSCipherSuite parameter using a secure cipher.
Which versions of OpenLDAP are affected by REDHAT-BUG-825875?
REDHAT-BUG-825875 affects OpenLDAP installations that utilize the Mozilla NSS backend.
What are the potential risks associated with REDHAT-BUG-825875?
The risks associated with REDHAT-BUG-825875 include potential exposure to cryptographic vulnerabilities due to weak ciphers.
Is there a workaround for REDHAT-BUG-825875?
A temporary workaround for REDHAT-BUG-825875 is to manually override the default cipher suite settings until a patch is applied.
- collector/redhat-bugzilla
- alias/CVE-2012-2668
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/description
- agent/references
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/openldap
- canonical/openldap