CVE-2019-13057

An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 68%
Affected Products (NVD)
VendorProductVersion
openldapopenldap
𝑥
< 2.4.48
canonicalubuntu_linux
12.04
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
19.04
debiandebian_linux
8.0
opensuseleap
15.0
opensuseleap
15.1
applemac_os_x
10.13 ≤
𝑥
< 10.13.6
applemac_os_x
10.14 ≤
𝑥
< 10.14.6
applemac_os_x
10.15 ≤
𝑥
< 10.15.2
applemac_os_x
10.13.6
applemac_os_x
10.13.6:security_update_2018-002
applemac_os_x
10.13.6:security_update_2018-003
applemac_os_x
10.13.6:security_update_2019-001
applemac_os_x
10.13.6:security_update_2019-002
applemac_os_x
10.13.6:security_update_2019-003
applemac_os_x
10.13.6:security_update_2019-004
applemac_os_x
10.13.6:security_update_2019-005
applemac_os_x
10.13.6:security_update_2019-006
applemac_os_x
10.14.6
applemac_os_x
10.14.6
applemac_os_x
10.14.6:security_update_2019-001
mcafeepolicy_auditor
𝑥
< 6.5.1
mcafeepolicy_auditor
6.5.1
oracleblockchain_platform
𝑥
< 21.1.2
oraclezfs_storage_appliance_kit
8.8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openldap
bookworm
2.5.13+dfsg-5
fixed
bullseye
2.4.57+dfsg-3+deb11u1
fixed
bullseye (security)
2.4.57+dfsg-3+deb11u1
fixed
sid
2.5.18+dfsg-3
fixed
trixie
2.5.18+dfsg-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
openldap
bionic
Fixed 2.4.45+dfsg-1ubuntu1.3
released
disco
Fixed 2.4.47+dfsg-3ubuntu2.1
released
trusty
Fixed 2.4.31-1+nmu2ubuntu8.5+esm1
released
xenial
Fixed 2.4.42+dfsg-2ubuntu3.6
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libldap-2_4-2
suse enterprise desktop 15
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP1
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP2
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP3
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise desktop 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise desktop 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise desktop 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise sap 15
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP1
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP2
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise sap 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise sap 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise sap 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise server 12 SP1
2.4.41-18.24.17.1
fixed
suse enterprise server 12 SP3
2.4.41-18.63.1
fixed
suse enterprise server 15
2.4.46-9.19.2
fixed
suse enterprise server 15 SP1
2.4.46-9.19.2
fixed
suse enterprise server 15 SP2
2.4.46-9.19.2
fixed
suse enterprise server 15 SP3
2.4.46-9.19.2
fixed
suse enterprise server 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise server 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise server 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise server 15 SP7
2.4.46-150600.23.21
fixed
libldap-2_4-2-32bit
suse enterprise desktop 15
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP1
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP2
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP3
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise desktop 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise desktop 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise desktop 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise sap 15
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP1
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP2
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise sap 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise sap 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise sap 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise server 12 SP1
2.4.41-18.24.17.1
fixed
suse enterprise server 12 SP3
2.4.41-18.63.1
fixed
suse enterprise server 15
2.4.46-9.19.2
fixed
suse enterprise server 15 SP1
2.4.46-9.19.2
fixed
suse enterprise server 15 SP2
2.4.46-9.19.2
fixed
suse enterprise server 15 SP3
2.4.46-9.19.2
fixed
suse enterprise server 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise server 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise server 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise server 15 SP7
2.4.46-150600.23.21
fixed
libldap-data
suse enterprise desktop 15 SP2
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP3
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise desktop 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise desktop 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise desktop 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise sap 15 SP2
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise sap 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise sap 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise sap 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise server 15 SP2
2.4.46-9.19.2
fixed
suse enterprise server 15 SP3
2.4.46-9.19.2
fixed
suse enterprise server 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise server 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise server 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise server 15 SP7
2.4.46-150600.23.21
fixed
openldap2
suse enterprise desktop 15 SP2
2.4.46-9.19.2
fixed
suse enterprise sap 15
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP1
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP2
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.19.2
fixed
suse enterprise server 12 SP1
2.4.41-18.24.17.1
fixed
suse enterprise server 12 SP3
2.4.41-18.63.1
fixed
suse enterprise server 15
2.4.46-9.19.2
fixed
suse enterprise server 15 SP1
2.4.46-9.19.2
fixed
suse enterprise server 15 SP2
2.4.46-9.19.2
fixed
suse enterprise server 15 SP3
2.4.46-9.19.2
fixed
openldap2-back-meta
suse enterprise sap 15
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP1
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP2
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.19.2
fixed
suse enterprise server 12 SP1
2.4.41-18.24.17.1
fixed
suse enterprise server 12 SP3
2.4.41-18.63.1
fixed
suse enterprise server 15
2.4.46-9.19.2
fixed
suse enterprise server 15 SP1
2.4.46-9.19.2
fixed
suse enterprise server 15 SP2
2.4.46-9.19.2
fixed
suse enterprise server 15 SP3
2.4.46-9.19.2
fixed
openldap2-back-perl
suse enterprise sap 15
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP1
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP2
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.19.2
fixed
suse enterprise server 15
2.4.46-9.19.2
fixed
suse enterprise server 15 SP1
2.4.46-9.19.2
fixed
suse enterprise server 15 SP2
2.4.46-9.19.2
fixed
suse enterprise server 15 SP3
2.4.46-9.19.2
fixed
openldap2-client
suse enterprise desktop 15
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP1
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP2
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP3
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise desktop 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise desktop 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise desktop 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise sap 15
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP1
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP2
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise sap 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise sap 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise sap 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise server 12 SP1
2.4.41-18.24.17.1
fixed
suse enterprise server 12 SP3
2.4.41-18.63.1
fixed
suse enterprise server 15
2.4.46-9.19.2
fixed
suse enterprise server 15 SP1
2.4.46-9.19.2
fixed
suse enterprise server 15 SP2
2.4.46-9.19.2
fixed
suse enterprise server 15 SP3
2.4.46-9.19.2
fixed
suse enterprise server 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise server 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise server 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise server 15 SP7
2.4.46-150600.23.21
fixed
openldap2-devel
suse enterprise desktop 15
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP1
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP2
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP3
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise desktop 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise desktop 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise desktop 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise sap 15
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP1
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP2
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise sap 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise sap 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise sap 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise server 15
2.4.46-9.19.2
fixed
suse enterprise server 15 SP1
2.4.46-9.19.2
fixed
suse enterprise server 15 SP2
2.4.46-9.19.2
fixed
suse enterprise server 15 SP3
2.4.46-9.19.2
fixed
suse enterprise server 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise server 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise server 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise server 15 SP7
2.4.46-150600.23.21
fixed
openldap2-devel-static
suse enterprise desktop 15
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP1
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP2
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP3
2.4.46-9.19.2
fixed
suse enterprise desktop 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise desktop 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise desktop 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise desktop 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise sap 15
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP1
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP2
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.19.2
fixed
suse enterprise sap 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise sap 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise sap 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise sap 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise server 15
2.4.46-9.19.2
fixed
suse enterprise server 15 SP1
2.4.46-9.19.2
fixed
suse enterprise server 15 SP2
2.4.46-9.19.2
fixed
suse enterprise server 15 SP3
2.4.46-9.19.2
fixed
suse enterprise server 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise server 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise server 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise server 15 SP7
2.4.46-150600.23.21
fixed
openldap2-doc
suse enterprise server 12 SP3
2.4.41-18.63.1
fixed
openldap2-ppolicy-check-password
suse enterprise desktop 15 SP2
1.2-9.19.2
fixed
suse enterprise sap 15 SP2
1.2-9.19.2
fixed
suse enterprise sap 15 SP3
1.2-9.19.2
fixed
suse enterprise server 15 SP2
1.2-9.19.2
fixed
suse enterprise server 15 SP3
1.2-9.19.2
fixed
References
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html
http://seclists.org/fulldisclosure/2019/Dec/26
https://kc.mcafee.com/corporate/index?page=content&id=SB10365
https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html
https://seclists.org/bugtraq/2019/Dec/23
https://security.netapp.com/advisory/ntap-20190822-0004/
https://support.apple.com/kb/HT210788
https://usn.ubuntu.com/4078-1/
https://usn.ubuntu.com/4078-2/
https://www.openldap.org/its/?findid=9038
https://www.openldap.org/lists/openldap-announce/201907/msg00001.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpuapr2022.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html
http://seclists.org/fulldisclosure/2019/Dec/26
https://kc.mcafee.com/corporate/index?page=content&id=SB10365
https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html
https://seclists.org/bugtraq/2019/Dec/23
https://security.netapp.com/advisory/ntap-20190822-0004/
https://support.apple.com/kb/HT210788
https://usn.ubuntu.com/4078-1/
https://usn.ubuntu.com/4078-2/
https://www.openldap.org/its/?findid=9038
https://www.openldap.org/lists/openldap-announce/201907/msg00001.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpuapr2022.html