CVE-2015-3276 describes a vulnerability in the nss_parse_ciphers function within OpenLDAP, specifically affecting its handling of OpenSSL-style cipher strings. This flaw could lead to the use of weaker ciphers than intended, impacting OpenLDAP, Oracle, and Red Hat products. With a CVSS score of 7.5 (HIGH), it presents a network-exploitable vulnerability with low attack complexity, potentially leading to high integrity impact without requiring user interaction. Despite its severity, there is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.5CPE matchmatch criteria | cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:* | ||
7CPE matchmatch criteria | cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* | ||
7.3CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:* | ||
7.4CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Third-Party Package Updates in Splunk Enterprise - October 2024
Oct 14, 2024CVE-2015-3276
Dec 14, 2021The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.
Dec 2, 2015openldap: incorrect multi-keyword mode cipherstring parsing
Jul 15, 2015