Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.

Published

2019-07-26T13:15:12.720

Last Modified

2024-11-21T04:25:11.190

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application openldap openldap ≤ 2.4.47 Yes
Operating System canonical ubuntu_linux 12.04 Yes
Operating System canonical ubuntu_linux 14.04 Yes
Operating System canonical ubuntu_linux 16.04 Yes
Operating System canonical ubuntu_linux 18.04 Yes
Operating System canonical ubuntu_linux 19.04 Yes
Operating System debian debian_linux 8.0 Yes
Operating System opensuse leap 15.0 Yes
Operating System opensuse leap 15.1 Yes
Application f5 traffix_signaling_delivery_controller 5.0.0 Yes
Application f5 traffix_signaling_delivery_controller 5.1.0 Yes
Operating System apple mac_os_x < 10.13.6 Yes
Operating System apple mac_os_x < 10.14.6 Yes
Operating System apple mac_os_x < 10.15.2 Yes
Operating System apple mac_os_x 10.13.6 Yes
Operating System apple mac_os_x 10.13.6 Yes
Operating System apple mac_os_x 10.13.6 Yes
Operating System apple mac_os_x 10.13.6 Yes
Operating System apple mac_os_x 10.13.6 Yes
Operating System apple mac_os_x 10.13.6 Yes
Operating System apple mac_os_x 10.13.6 Yes
Operating System apple mac_os_x 10.13.6 Yes
Operating System apple mac_os_x 10.13.6 Yes
Operating System apple mac_os_x 10.13.6 Yes
Operating System apple mac_os_x 10.14.6 Yes
Operating System apple mac_os_x 10.14.6 Yes
Application oracle blockchain_platform < 21.1.2 Yes
Application oracle zfs_storage_appliance_kit 8.8 Yes
Operating System oracle solaris 11 Yes
References