CVE-2015-3276 Weak cryptography in n/a

High 7.5 Published 7 Dec 2015 Updated 6 Aug 2024

OpenLDAP's cipher parsing flaw allows remote attackers to force weaker encryption, potentially compromising communication security.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2015-3276?

CVE-2015-3276 is a high-severity vulnerability in Openldap Openldap, published on 7 Dec 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

Which versions are affected by CVE-2015-3276?

It affects 9 products.

Products include Openldap Openldap, Oracle Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Server and 3 more.

How do I fix CVE-2015-3276?

Apply the vendor's patch.

Is CVE-2015-3276 being exploited?

There is no known exploitation of CVE-2015-3276 in the wild and no public exploit code.

All Openldap Openldap vulnerabilities

Sources

Also known as AZL-6770, DEBIAN-CVE-2015-3276, GHSA-cc3w-xgwq-vgw8, ROOT-OS-DEBIAN-12-CVE-2015-3276.