CVE-2019-13057
An issue was discovered in the server in OpenLDAP before 2.4.48.
Does this matter?
Lower severity and a low EPSS score (3.42%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)
- CVSS 3.1
- 4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 3.42% probability · 88th percentile
- CISA KEV
- Not listed
- Affected
- openldap/openldap · canonical/ubuntu linux · debian/debian linux · opensuse/leap · apple/mac os x · mcafee/policy auditor · oracle/blockchain platform · oracle/zfs storage appliance kit · oracle/solaris
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.htmlMailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Dec/26Mailing List, Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00024.htmlMailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Dec/23Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190822-0004/Third Party Advisory
- https://support.apple.com/kb/HT210788Third Party Advisory
- https://usn.ubuntu.com/4078-1/Third Party Advisory
- https://usn.ubuntu.com/4078-2/Third Party Advisory
- https://www.openldap.org/its/?findid=9038Mailing List, Vendor Advisory
- https://www.openldap.org/lists/openldap-announce/201907/msg00001.htmlMailing List, Product, Vendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.htmlMailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Dec/26Mailing List, Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00024.htmlMailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Dec/23Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190822-0004/Third Party Advisory
- https://support.apple.com/kb/HT210788Third Party Advisory
- https://usn.ubuntu.com/4078-1/Third Party Advisory
- https://usn.ubuntu.com/4078-2/Third Party Advisory
- https://www.openldap.org/its/?findid=9038Mailing List, Vendor Advisory
- https://www.openldap.org/lists/openldap-announce/201907/msg00001.htmlMailing List, Product, Vendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.