CVE-2015-3276

HIGH

OpenLDAP < 2.5 - Weak Cipher Usage via OpenSSL-Style Cipher String Parsing

Title source: llm
STIX 2.1

Description

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

References (4)

Core 4
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-2131.html
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1238322
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034221

Scores

CVSS v3 7.5
EPSS 0.0533
EPSS Percentile 91.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

Status published
Products (18)
openldap/openldap < 2.5
oracle/linux 7
redhat/enterprise_linux_desktop 7.0
redhat/enterprise_linux_eus 7.3
redhat/enterprise_linux_eus 7.4
redhat/enterprise_linux_eus 7.5
redhat/enterprise_linux_eus 7.6
redhat/enterprise_linux_eus 7.7
redhat/enterprise_linux_hpc_node 7.0
redhat/enterprise_linux_server 7.0
... and 8 more
Published Dec 07, 2015
Tracked Since Feb 18, 2026