{"id":"CVE-2019-13057","aliases":["ALPINE-CVE-2019-13057","BELL-CVE-2019-13057","DEBIAN-CVE-2019-13057","DLA-1891-1","EUVD-2019-4617","GHSA-5x95-66xj-7chm","MGASA-2019-0280","SUSE-SU-2019:2390-1","SUSE-SU-2019:2395-1","SUSE-SU-2020:1210-1","SUSE-SU-2020:14353-1","UBUNTU-CVE-2019-13057","USN-4078-1","USN-4078-2","openSUSE-SU-2019:2157-1","openSUSE-SU-2019:2176-1","openSUSE-SU-2024:11121-1"],"status":"published","title":"An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator...","description":"An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.06595,"percentile":0.93927,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-07-26T00:00:00Z","modified":"2026-11-02T07:26:44Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openldap","fixed_in":["2.4.48+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openldap","fixed_in":["2.4.48+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openldap","fixed_in":["2.4.48+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openldap","fixed_in":["2.4.31-1+nmu2ubuntu8.5+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"openldap","fixed_in":["2.4.42+dfsg-2ubuntu3.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"openldap","fixed_in":["2.4.45+dfsg-1ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.40+dfsg-1+deb8u5"}]}],"versions":["2.4.40+dfsg-1","2.4.40+dfsg-1+deb8u1","2.4.40+dfsg-1+deb8u2","2.4.40+dfsg-1+deb8u3","2.4.40+dfsg-1+deb8u4"],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.45-2.1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.47-3.1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.63.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.63.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.63.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.63.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"openldap2-client-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.26-0.74.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.31-1+nmu2ubuntu8.5+esm1"}]}],"versions":["2.4.31-1+nmu2ubuntu3","2.4.31-1+nmu2ubuntu4","2.4.31-1+nmu2ubuntu5","2.4.31-1+nmu2ubuntu8","2.4.31-1+nmu2ubuntu8.1","2.4.31-1+nmu2ubuntu8.2","2.4.31-1+nmu2ubuntu8.3","2.4.31-1+nmu2ubuntu8.4","2.4.31-1+nmu2ubuntu8.5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.42+dfsg-2ubuntu3.6"}]}],"versions":["2.4.41+dfsg-1ubuntu2","2.4.41+dfsg-1ubuntu3","2.4.42+dfsg-2ubuntu1","2.4.42+dfsg-2ubuntu3","2.4.42+dfsg-2ubuntu3.1","2.4.42+dfsg-2ubuntu3.2","2.4.42+dfsg-2ubuntu3.3","2.4.42+dfsg-2ubuntu3.4","2.4.42+dfsg-2ubuntu3.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.45+dfsg-1ubuntu1.3"}]}],"versions":["2.4.45+dfsg-1ubuntu1","2.4.45+dfsg-1ubuntu1.1","2.4.45+dfsg-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.42+dfsg-2ubuntu3.6"}]}],"versions":["2.4.41+dfsg-1ubuntu2","2.4.41+dfsg-1ubuntu3","2.4.42+dfsg-2ubuntu1","2.4.42+dfsg-2ubuntu3","2.4.42+dfsg-2ubuntu3.1","2.4.42+dfsg-2ubuntu3.2","2.4.42+dfsg-2ubuntu3.3","2.4.42+dfsg-2ubuntu3.4","2.4.42+dfsg-2ubuntu3.5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.45+dfsg-1ubuntu1.3"}]}],"versions":["2.4.45+dfsg-1ubuntu1","2.4.45+dfsg-1ubuntu1.1","2.4.45+dfsg-1ubuntu1.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.31-1+nmu2ubuntu8.5+esm1"}]}],"versions":["2.4.31-1+nmu2ubuntu3","2.4.31-1+nmu2ubuntu4","2.4.31-1+nmu2ubuntu5","2.4.31-1+nmu2ubuntu8","2.4.31-1+nmu2ubuntu8.1","2.4.31-1+nmu2ubuntu8.2","2.4.31-1+nmu2ubuntu8.3","2.4.31-1+nmu2ubuntu8.4","2.4.31-1+nmu2ubuntu8.5"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-lp151.10.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-lp150.13.1"}]}],"bundled":3}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"mcafee","product":"policy_auditor"},{"vendor":"openldap","product":"openldap"},{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"blockchain_platform"},{"vendor":"oracle","product":"solaris"},{"vendor":"oracle","product":"zfs_storage_appliance_kit"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://usn.ubuntu.com/4078-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4078-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2019/Dec/23","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2019/Dec/26","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://support.apple.com/kb/HT210788","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.openldap.org/its/?findid=9038","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory"]},{"url":"https://www.openldap.org/lists/openldap-announce/201907/msg00001.html","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Product","Vendor Advisory","advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20190822-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13057"},{"url":"https://security.netapp.com/advisory/ntap-20190822-0004"},{"url":"https://usn.ubuntu.com/4078-1"},{"url":"https://usn.ubuntu.com/4078-2"},{"url":"https://github.com/advisories/GHSA-5x95-66xj-7chm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-13057","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-13057","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13057","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0280.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25286","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192390-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1143194","tags":["report"]},{"url":"https://bugzilla.suse.com/1143273","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13565","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192395-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1073313","tags":["report"]},{"url":"https://bugzilla.suse.com/1111388","tags":["report"]},{"url":"https://bugzilla.suse.com/1114845","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17740","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201210-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1170771","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12243","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014353-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-13057","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4078-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4078-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13565","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/46KFS6OC36UWKEJS7D2YUROL2323KWEB/#46KFS6OC36UWKEJS7D2YUROL2323KWEB","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TQYMYQN54XQCPQJJZEIGGCBW3W7U53IW/#TQYMYQN54XQCPQJJZEIGGCBW3W7U53IW","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8027","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-13057","description":"An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)","status":"published","published":"2019-07-26T12:19:25Z","modified":"2026-10-14T06:50:03.637Z","updated_at":"2026-11-02T14:20:24.357095Z"}],"euvd":[{"id":"EUVD-2019-4617","description":"An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)","status":"published","published":"2019-07-26T12:19:25Z","modified":"2026-10-14T06:50:03Z","updated_at":"2026-11-02T17:27:17.374818Z"}],"ghsa":[{"id":"GHSA-5x95-66xj-7chm","title":"An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator...","description":"An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)","status":"published","published":"2022-05-24T16:51:29Z","modified":"2026-10-14T09:32:28Z","cvss":[{"version":"3.0","score":4.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:13:23.530725Z"}],"nvd":[{"id":"CVE-2019-13057","description":"An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)","status":"published","published":"2019-07-26T13:15:12.317Z","modified":"2026-10-14T07:16:46.07Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"ALPINE-CVE-2019-13057","description":"An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)","status":"published","published":"2019-07-26T13:15:12.317Z","modified":"2026-09-21T06:17:52.473358099Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-13057","title":"CVE-2019-13057 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:35.136249Z","modified":"2026-03-05T07:15:14.230185Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-13057","description":"An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)","status":"published","published":"2019-07-26T13:15:12.317Z","modified":"2026-11-02T07:26:44.509351318Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-13057","description":"An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)","status":"published","published":"2019-07-26T13:15:12.317Z","modified":"2026-10-15T07:47:33.125271034Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-13057","description":"An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)","status":"published","published":"2019-07-26T00:00:00Z","modified":"2026-04-22T12:09:37.60109Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.0","score":4.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"DLA-1891-1","title":"openldap - security update","status":"published","published":"2019-08-18T00:00:00Z","modified":"2026-03-09T01:21:02.463851Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2019-0280","title":"Updated openldap packages fix security vulnerabilities","description":"Updated openldap packages fix security vulnerabilities:\nIt was discovered that OpenLDAP incorrectly handled rootDN delegation.\nA database administrator could use this issue to request authorization\nas an identity from another database, contrary to expectations\n(CVE-2019-13057).\n\nIt was discovered that OpenLDAP incorrectly handled SASL authentication\nand session encryption. After a first SASL bind was completed, it was\npossible to obtain access by performing simple binds, contrary to\nexpectations (CVE-2019-13565).\n","status":"published","published":"2019-09-15T14:45:31Z","modified":"2026-04-16T04:44:23.680970082Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:2157-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194).\n- CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273).\n- CVE-2017-17740: When both the nops module and the member of overlay\n  are enabled, attempts to free a buffer that was allocated on the stack,\n  which allows remote attackers to cause a denial of service (slapd crash)\n  via a member MODDN operation. (bsc#1073313)\n\nNon-security issues fixed:\n\n- Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845).\n- Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388)\n- Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-23T18:19:38Z","modified":"2026-02-04T03:01:08.357746Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2176-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194).\n- CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273).\n- CVE-2017-17740: When both the nops module and the member of overlay\n  are enabled, attempts to free a buffer that was allocated on the stack,\n  which allows remote attackers to cause a denial of service (slapd crash)\n  via a member MODDN operation. (bsc#1073313)\n\nNon-security issues fixed:\n\n- Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845).\n- Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388)\n- Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-24T08:20:38Z","modified":"2026-02-04T02:59:45.283421Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11121-1","title":"libldap-2_4-2-2.4.59-69.3 on GA media","description":"These are all security issues fixed in the libldap-2_4-2-2.4.59-69.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:12:22.368649Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:2390-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-13565: Fixed ssf memory reuse that leads to incorrect authorization of another connection, granting excess connection rights (ssf) (bsc#1143194).\n- CVE-2019-13057: Fixed rootDN of a backend that may proxyauth incorrectly to another backend, violating multi-tenant isolation (bsc#1143273).\n","status":"published","published":"2019-09-17T13:46:09Z","modified":"2026-02-04T04:05:49.7692Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2395-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194).\n- CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273).\n- CVE-2017-17740: When both the nops module and the member of overlay\n  are enabled, attempts to free a buffer that was allocated on the stack,\n  which allows remote attackers to cause a denial of service (slapd crash)\n  via a member MODDN operation. (bsc#1073313)\n\nNon-security issues fixed:\n\n- Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845).\n- Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388)\n- Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).\n","status":"published","published":"2019-09-18T06:31:55Z","modified":"2026-02-04T04:21:30.820036Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2020:1210-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\n- CVE-2020-12243: Fixed a denial of service related to recursive filters (bsc#1170771).\n- CVE-2019-13565: Fixed an authentication bypass caused by incorrect authorization of another connection, granting excess connection rights (bsc#1143194).\n- CVE-2019-13057: Fixed an issue with improper authorization with delegated database admin privileges (bsc#1143273).\n","status":"published","published":"2020-05-07T08:38:25Z","modified":"2026-02-04T04:39:44.568845Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:14353-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\n- CVE-2019-13565: Fixed an authentication bypass caused by incorrect authorization of another connection, granting excess connection rights (bsc#1143194).\n- CVE-2019-13057: Fixed an issue with improper authorization with delegated database admin privileges (bsc#1143273).\n","status":"published","published":"2020-04-29T20:55:45Z","modified":"2026-02-04T04:00:06.001384Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4078-1","title":"openldap vulnerabilities","description":"It was discovered that OpenLDAP incorrectly handled rootDN delegation. A\ndatabase administrator could use this issue to request authorization as an\nidentity from another database, contrary to expectations. (CVE-2019-13057)\n\nIt was discovered that OpenLDAP incorrectly handled SASL authentication and\nsession encryption. After a first SASL bind was completed, it was possible\nto obtain access by performing simple binds, contrary to expectations.\n(CVE-2019-13565)\n","status":"published","published":"2019-07-30T16:50:18Z","modified":"2026-04-22T09:59:29.209239Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4078-2","title":"openldap vulnerabilities","description":"USN-4078-1 fixed several vulnerabilities in openldap. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that OpenLDAP incorrectly handled rootDN delegation. A\n database administrator could use this issue to request authorization as an\n identity from another database, contrary to expectations. (CVE-2019-13057)\n\n It was discovered that OpenLDAP incorrectly handled SASL authentication and\n session encryption. After a first SASL bind was completed, it was possible\n to obtain access by performing simple binds, contrary to expectations.\n (CVE-2019-13565)\n","status":"published","published":"2019-08-19T13:12:55Z","modified":"2026-04-22T09:58:39.413789Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}