CVE-2012-2668: libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, alw...

Security readout for executives and security teams

OpenLDAP could silently ignore an administrator’s chosen TLS cipher policy when built with the Mozilla NSS TLS backend. That means encrypted LDAP connections might use weaker default ciphers than intended, increasing confidentiality risk for directory data if affected systems are still in use. Exposure is most likely on older OpenLDAP deployments using the Mozilla NSS backend and relying on TLSCipherSuite to enforce cipher policy. Environments using different TLS backends, unaffected package builds, or updated vendor packages may not be exposed. The bundle does not provide complete product/version coverage. Treat this as a targeted hygiene issue for legacy directory infrastructure. It is not shown as actively exploited, but it can undermine encryption policy assumptions around identity data. Prioritize systems handling sensitive authentication or directory traffic, especially older Linux distributions or embedded appliances. Mitigation focus: Identify OpenLDAP systems using the Mozilla NSS TLS backend.; Apply relevant vendor OpenLDAP security updates or fixed packages.; Review Red Hat, Gentoo, Debian, or OpenLDAP guidance for affected builds..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.