CVEvulnerability
CVE-2019-13057
4.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-07-26
- Last modified
- 2026-10-14
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:P/I:N/A:N
Description
An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)
Affected configurations
• openldap openldap (< 2.4.48)
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 19.04
• debian debian linux 8.0
• opensuse leap 15.0
• opensuse leap 15.1
• apple mac os x (>= 10.13 < 10.13.6)
• apple mac os x (>= 10.14 < 10.14.6)
• apple mac os x (>= 10.15 < 10.15.2)
• apple mac os x 10.13.6
• apple mac os x 10.14.6
• mcafee policy auditor (< 6.5.1)
• mcafee policy auditor 6.5.1
• oracle blockchain platform (< 21.1.2)
• oracle zfs storage appliance kit 8.8
• oracle solaris 11
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Dec/26 Mailing List, Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Dec/23 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190822-0004/ Third Party Advisory
- https://support.apple.com/kb/HT210788 Third Party Advisory
- https://usn.ubuntu.com/4078-1/ Third Party Advisory
- https://usn.ubuntu.com/4078-2/ Third Party Advisory
- https://www.openldap.org/its/?findid=9038 Mailing List, Vendor Advisory
- https://www.openldap.org/lists/openldap-announce/201907/msg00001.html Mailing List, Product, Vendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Dec/26 Mailing List, Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Dec/23 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190822-0004/ Third Party Advisory
- https://support.apple.com/kb/HT210788 Third Party Advisory
- https://usn.ubuntu.com/4078-1/ Third Party Advisory
- https://usn.ubuntu.com/4078-2/ Third Party Advisory
- https://www.openldap.org/its/?findid=9038 Mailing List, Vendor Advisory
- https://www.openldap.org/lists/openldap-announce/201907/msg00001.html Mailing List, Product, Vendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html cert-portal.siemens.com