CVE-2015-3276 The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be u...
HighCVSS 7.5
EPSS 5.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openldap(Debian:12) | All versions | No fix listed |
| debian/openldap(Debian:12) | = 1:1.2.12-1 | No fix listed |
| debian/openldap(Debian:12) | = 2.5.13+dfsg-5 | No fix listed |
| debian/openldap(Debian:12) | = 2.5.13+dfsg-5+loong64 | No fix listed |
| debian/openldap(Debian:12) | = 2.5.16+dfsg-1 | No fix listed |
| debian/openldap(Debian:12) | = 2.5.16+dfsg-2 | No fix listed |
| debian/openldap(Debian:12) | = 2.5.17+dfsg-1 | No fix listed |
| debian/openldap(Debian:12) | = 2.5.18+dfsg-1 | No fix listed |
| debian/openldap(Debian:12) | = 2.5.18+dfsg-2 | No fix listed |
| debian/openldap(Debian:12) | = 2.5.18+dfsg-3 | No fix listed |
| debian/openldap(Debian:12) | = 2.5.19+dfsg-1 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.10+dfsg-1 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.13+dfsg-1 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.14+dfsg-1 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.14+dfsg-2 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.2+dfsg-1~exp1 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.2+dfsg-1~exp2 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.3+dfsg-1~exp1 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.4+dfsg-1~exp1 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.5+dfsg-1~exp1 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.6+dfsg-1~exp1 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.6+dfsg-1~exp2 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.7+dfsg-1~exp1 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.8+dfsg-1~exp1 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.8+dfsg-1~exp2 | No fix listed |
Show 42 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openldap(Debian:12) | = 2.6.8+dfsg-1~exp3 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.8+dfsg-1~exp4 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.9+dfsg-1 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.9+dfsg-1~exp1 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.9+dfsg-1~exp2 | No fix listed |
| debian/openldap(Debian:12) | = 2.6.9+dfsg-2 | No fix listed |
| debian/openldap(Debian:12) | = 2:1.2.12.1-1 | No fix listed |
| debian/openldap(Debian:12) | = 2:1.2.12.1-1.0.1 | No fix listed |
| debian/openldap(Debian:13) | All versions | No fix listed |
| debian/openldap(Debian:13) | = 1:1.2.12-1 | No fix listed |
| debian/openldap(Debian:13) | = 2.6.10+dfsg-1 | No fix listed |
| debian/openldap(Debian:13) | = 2.6.13+dfsg-1 | No fix listed |
| debian/openldap(Debian:13) | = 2.6.14+dfsg-1 | No fix listed |
| debian/openldap(Debian:13) | = 2.6.14+dfsg-2 | No fix listed |
| debian/openldap(Debian:13) | = 2:1.2.12.1-1 | No fix listed |
| debian/openldap(Debian:13) | = 2:1.2.12.1-1.0.1 | No fix listed |
| debian/openldap(Debian:14) | All versions | No fix listed |
| debian/openldap(Debian:14) | = 1:1.2.12-1 | No fix listed |
| debian/openldap(Debian:14) | = 2.6.10+dfsg-1 | No fix listed |
| debian/openldap(Debian:14) | = 2.6.13+dfsg-1 | No fix listed |
| debian/openldap(Debian:14) | = 2.6.14+dfsg-1 | No fix listed |
| debian/openldap(Debian:14) | = 2.6.14+dfsg-2 | No fix listed |
| debian/openldap(Debian:14) | = 2:1.2.12.1-1 | No fix listed |
| debian/openldap(Debian:14) | = 2:1.2.12.1-1.0.1 | No fix listed |
| openldap | < 2.5 | 2.5 |
| oracle linux | = 7 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 7.3 | No fix listed |
| redhat enterprise linux eus | = 7.4 | No fix listed |
| redhat enterprise linux eus | = 7.5 | No fix listed |
| redhat enterprise linux eus | = 7.6 | No fix listed |
| redhat enterprise linux eus | = 7.7 | No fix listed |
| redhat enterprise linux hpc node | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
References
- Debian Security Tracker CVE-2015-3276 vendor-advisory
- RHSA-2015:2131 third-party-advisory vendor-advisory
- www.oracle.com third-party-advisory
- 1034221 broken-link third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking patch third-party-advisory