CVE-2019-13057

An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)
Configurations

Configuration 1 (hide)

cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-006:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-005:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:-:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.14.6:*:*:*:*:*:*:*

Configuration 6 (hide)

OR cpe:2.3:a:mcafee:policy_auditor:*:*:*:*:*:*:*:*
cpe:2.3:a:mcafee:policy_auditor:6.5.1:*:*:*:*:*:*:*

Configuration 7 (hide)

OR cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*

History

13 Jun 2022, 18:38

Type Values Removed Values Added
First Time Oracle solaris
Opensuse leap
Debian
Oracle zfs Storage Appliance Kit
Apple
Mcafee
Opensuse
Debian debian Linux
Mcafee policy Auditor
Oracle blockchain Platform
Apple mac Os X
Oracle
CPE cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:*
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-005:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:*
cpe:2.3:a:mcafee:policy_auditor:6.5.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:-:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.14.6:*:*:*:*:*:*:*
cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*
cpe:2.3:a:mcafee:policy_auditor:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-006:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*
References (MLIST) https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html - (MLIST) https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html - Mailing List, Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2019/Dec/26 - (FULLDISC) http://seclists.org/fulldisclosure/2019/Dec/26 - Mailing List, Third Party Advisory
References (CONFIRM) https://security.netapp.com/advisory/ntap-20190822-0004/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20190822-0004/ - Third Party Advisory
References (BUGTRAQ) https://seclists.org/bugtraq/2019/Dec/23 - (BUGTRAQ) https://seclists.org/bugtraq/2019/Dec/23 - Mailing List, Third Party Advisory
References (UBUNTU) https://usn.ubuntu.com/4078-2/ - (UBUNTU) https://usn.ubuntu.com/4078-2/ - Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html - Mailing List, Third Party Advisory
References (MISC) https://www.oracle.com/security-alerts/cpuapr2022.html - (MISC) https://www.oracle.com/security-alerts/cpuapr2022.html - Patch, Third Party Advisory
References (CONFIRM) https://kc.mcafee.com/corporate/index?page=content&id=SB10365 - (CONFIRM) https://kc.mcafee.com/corporate/index?page=content&id=SB10365 - Third Party Advisory
References (CONFIRM) https://support.apple.com/kb/HT210788 - (CONFIRM) https://support.apple.com/kb/HT210788 - Third Party Advisory
References (N/A) https://www.oracle.com/security-alerts/cpuapr2020.html - (N/A) https://www.oracle.com/security-alerts/cpuapr2020.html - Patch, Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html - Mailing List, Third Party Advisory

20 Apr 2022, 00:15

Type Values Removed Values Added
References
  • (MISC) https://www.oracle.com/security-alerts/cpuapr2022.html -
  • (CONFIRM) https://kc.mcafee.com/corporate/index?page=content&id=SB10365 -

Information

Published : 2019-07-26 13:15

Updated : 2022-06-13 18:38


NVD link : CVE-2019-13057

Mitre link : CVE-2019-13057


JSON object : View

Products Affected

opensuse

  • leap

canonical

  • ubuntu_linux

openldap

  • openldap

oracle

  • blockchain_platform
  • solaris
  • zfs_storage_appliance_kit

debian

  • debian_linux

apple

  • mac_os_x

mcafee

  • policy_auditor