CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.

• CVE-2019-13565: SASL session encryption SSF not reset on new connection, allowing downgrade
• CVE-2020-12243: slapd crash via deeply nested LDAP search filter boolean expressions
• CVE-2020-25692: NULL pointer dereference in slapd during modRDN request
• CVE-2020-25709: slapd assertion failure via crafted certificate list validation
• CVE-2020-25710: slapd assertion failure in obsolete csnNormalize23
• CVE-2020-36221: slapd integer underflow crash in Certificate Exact Assertion processing
• CVE-2020-36222: slapd assertion failure in saslAuthzTo validation
• CVE-2020-36223: slapd double free crash in Values Return Filter control handling
• CVE-2020-36224: slapd invalid pointer free and crash in saslAuthzTo processing
• CVE-2020-36225: slapd double free crash in saslAuthzTo processing
• CVE-2020-36226: slapd memch->bv_len miscalculation and crash in saslAuthzTo processing
• CVE-2020-36227: slapd infinite loop via cancel_extop Cancel operation
• CVE-2020-36228: slapd integer underflow crash in Certificate List Exact Assertion processing
• CVE-2020-36229: slapd crash in X.509 DN parsing ad_keystring via ldap_X509dn2bv
• CVE-2020-36230: slapd assertion failure in X.509 DN parsing ber_next_element in decode.c

• CVE-2019-13565: SASL session encryption SSF not reset on new connection, allowing downgrade
• CVE-2020-12243: slapd crash via deeply nested LDAP search filter boolean expressions
• CVE-2020-25692: NULL pointer dereference in slapd during modRDN request
• CVE-2020-25709: slapd assertion failure via crafted certificate list validation
• CVE-2020-25710: slapd assertion failure in obsolete csnNormalize23
• CVE-2020-36221: slapd integer underflow crash in Certificate Exact Assertion processing
• CVE-2020-36222: slapd assertion failure in saslAuthzTo validation
• CVE-2020-36223: slapd double free crash in Values Return Filter control handling
• CVE-2020-36224: slapd invalid pointer free and crash in saslAuthzTo processing
• CVE-2020-36225: slapd double free crash in saslAuthzTo processing
• CVE-2020-36226: slapd memch->bv_len miscalculation and crash in saslAuthzTo processing
• CVE-2020-36227: slapd infinite loop via cancel_extop Cancel operation
• CVE-2020-36228: slapd integer underflow crash in Certificate List Exact Assertion processing
• CVE-2020-36229: slapd crash in X.509 DN parsing ad_keystring via ldap_X509dn2bv
• CVE-2020-36230: slapd assertion failure in X.509 DN parsing ber_next_element in decode.c

Updated openldap packages fix security vulnerabilities: It was discovered that OpenLDAP incorrectly handled rootDN delegation. A database administrator could use this issue to request authorization as an identity from another database, contrary to expectations (CVE-2019-13057).

It was discovered that OpenLDAP incorrectly handled SASL authentication and session encryption. After a first SASL bind was completed, it was possible to obtain access by performing simple binds, contrary to expectations (CVE-2019-13565).

This update for openldap2 fixes the following issues:

Security issue fixed:

• CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194).
• CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273).
• CVE-2017-17740: When both the nops module and the member of overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation. (bsc#1073313)

Non-security issues fixed:

• Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845).
• Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388)
• Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).

This update was imported from the SUSE:SLE-15:Update update project.

This update for openldap2 fixes the following issues:

Security issue fixed:

• CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194).
• CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273).
• CVE-2017-17740: When both the nops module and the member of overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation. (bsc#1073313)

Non-security issues fixed:

• Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845).
• Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388)
• Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libldap-2_4-2-2.4.59-69.3 package on the GA media of openSUSE Tumbleweed.

This update for openldap2 fixes the following issues:

Security issues fixed:

• CVE-2019-13565: Fixed ssf memory reuse that leads to incorrect authorization of another connection, granting excess connection rights (ssf) (bsc#1143194).
• CVE-2019-13057: Fixed rootDN of a backend that may proxyauth incorrectly to another backend, violating multi-tenant isolation (bsc#1143273).

This update for openldap2 fixes the following issues:

Security issue fixed:

• CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194).
• CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273).
• CVE-2017-17740: When both the nops module and the member of overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation. (bsc#1073313)

Non-security issues fixed:

• Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845).
• Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388)
• Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).

This update for openldap2 fixes the following issues:

• CVE-2020-12243: Fixed a denial of service related to recursive filters (bsc#1170771).
• CVE-2019-13565: Fixed an authentication bypass caused by incorrect authorization of another connection, granting excess connection rights (bsc#1143194).
• CVE-2019-13057: Fixed an issue with improper authorization with delegated database admin privileges (bsc#1143273).

This update for openldap2 fixes the following issues:

• CVE-2019-13565: Fixed an authentication bypass caused by incorrect authorization of another connection, granting excess connection rights (bsc#1143194).
• CVE-2019-13057: Fixed an issue with improper authorization with delegated database admin privileges (bsc#1143273).

It was discovered that OpenLDAP incorrectly handled rootDN delegation. A database administrator could use this issue to request authorization as an identity from another database, contrary to expectations. (CVE-2019-13057)

It was discovered that OpenLDAP incorrectly handled SASL authentication and session encryption. After a first SASL bind was completed, it was possible to obtain access by performing simple binds, contrary to expectations. (CVE-2019-13565)

USN-4078-1 fixed several vulnerabilities in openldap. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that OpenLDAP incorrectly handled rootDN delegation. A database administrator could use this issue to request authorization as an identity from another database, contrary to expectations. (CVE-2019-13057)

It was discovered that OpenLDAP incorrectly handled SASL authentication and session encryption. After a first SASL bind was completed, it was possible to obtain access by performing simple binds, contrary to expectations. (CVE-2019-13565)