{"id":"CVE-2019-13565","aliases":["ALPINE-CVE-2019-13565","BELL-CVE-2019-13565","CLSA-2026-1777310722","CLSA-2026-1777393215","DEBIAN-CVE-2019-13565","DLA-1891-1","EUVD-2019-5020","GHSA-49q9-mmpr-r526","MGASA-2019-0280","SUSE-SU-2019:2390-1","SUSE-SU-2019:2395-1","SUSE-SU-2020:1210-1","SUSE-SU-2020:14353-1","UBUNTU-CVE-2019-13565","USN-4078-1","USN-4078-2","openSUSE-SU-2019:2157-1","openSUSE-SU-2019:2176-1","openSUSE-SU-2024:11121-1"],"status":"published","title":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session...","description":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.05015,"percentile":0.92317,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-07-26T00:00:00Z","modified":"2026-11-02T02:45:55Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"openldap","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openldap","fixed_in":["2.4.48+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openldap","fixed_in":["2.4.48+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openldap","fixed_in":["2.4.48+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openldap","fixed_in":["2.4.31-1+nmu2ubuntu8.5+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"openldap","fixed_in":["2.4.42+dfsg-2ubuntu3.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"openldap","fixed_in":["2.4.45+dfsg-1ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-18.el8.tuxcare.els4"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openldap-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-18.el8.tuxcare.els4"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openldap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-18.el8.tuxcare.els4"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openldap-servers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-18.el8.tuxcare.els4"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-17.el8_4.tuxcare.els4"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openldap-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-17.el8_4.tuxcare.els4"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openldap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-17.el8_4.tuxcare.els4"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openldap-servers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-17.el8_4.tuxcare.els4"}]}],"bundled":15},{"source":"osv","ecosystem":"Debian:12","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.40+dfsg-1+deb8u5"}]}],"versions":["2.4.40+dfsg-1","2.4.40+dfsg-1+deb8u1","2.4.40+dfsg-1+deb8u2","2.4.40+dfsg-1+deb8u3","2.4.40+dfsg-1+deb8u4"],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.45-2.1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.47-3.1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.63.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.63.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.63.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.63.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"openldap2-client-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.26-0.74.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.31-1+nmu2ubuntu8.5+esm1"}]}],"versions":["2.4.31-1+nmu2ubuntu3","2.4.31-1+nmu2ubuntu4","2.4.31-1+nmu2ubuntu5","2.4.31-1+nmu2ubuntu8","2.4.31-1+nmu2ubuntu8.1","2.4.31-1+nmu2ubuntu8.2","2.4.31-1+nmu2ubuntu8.3","2.4.31-1+nmu2ubuntu8.4","2.4.31-1+nmu2ubuntu8.5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.42+dfsg-2ubuntu3.6"}]}],"versions":["2.4.41+dfsg-1ubuntu2","2.4.41+dfsg-1ubuntu3","2.4.42+dfsg-2ubuntu1","2.4.42+dfsg-2ubuntu3","2.4.42+dfsg-2ubuntu3.1","2.4.42+dfsg-2ubuntu3.2","2.4.42+dfsg-2ubuntu3.3","2.4.42+dfsg-2ubuntu3.4","2.4.42+dfsg-2ubuntu3.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.45+dfsg-1ubuntu1.3"}]}],"versions":["2.4.45+dfsg-1ubuntu1","2.4.45+dfsg-1ubuntu1.1","2.4.45+dfsg-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.42+dfsg-2ubuntu3.6"}]}],"versions":["2.4.41+dfsg-1ubuntu2","2.4.41+dfsg-1ubuntu3","2.4.42+dfsg-2ubuntu1","2.4.42+dfsg-2ubuntu3","2.4.42+dfsg-2ubuntu3.1","2.4.42+dfsg-2ubuntu3.2","2.4.42+dfsg-2ubuntu3.3","2.4.42+dfsg-2ubuntu3.4","2.4.42+dfsg-2ubuntu3.5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.45+dfsg-1ubuntu1.3"}]}],"versions":["2.4.45+dfsg-1ubuntu1","2.4.45+dfsg-1ubuntu1.1","2.4.45+dfsg-1ubuntu1.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.31-1+nmu2ubuntu8.5+esm1"}]}],"versions":["2.4.31-1+nmu2ubuntu3","2.4.31-1+nmu2ubuntu4","2.4.31-1+nmu2ubuntu5","2.4.31-1+nmu2ubuntu8","2.4.31-1+nmu2ubuntu8.1","2.4.31-1+nmu2ubuntu8.2","2.4.31-1+nmu2ubuntu8.3","2.4.31-1+nmu2ubuntu8.4","2.4.31-1+nmu2ubuntu8.5"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-lp151.10.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-lp150.13.1"}]}],"bundled":3}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"f5","product":"traffix_signaling_delivery_controller"},{"vendor":"openldap","product":"openldap"},{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"blockchain_platform"},{"vendor":"oracle","product":"solaris"},{"vendor":"oracle","product":"zfs_storage_appliance_kit"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://usn.ubuntu.com/4078-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4078-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2019/Dec/23","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2019/Dec/26","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://support.apple.com/kb/HT210788","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.openldap.org/lists/openldap-announce/201907/msg00001.html","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Vendor Advisory","advisory","report"]},{"url":"https://www.openldap.org/its/index.cgi/?findid=9052","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory"]},{"url":"https://support.f5.com/csp/article/K98008862?utm_source=f5support\u0026amp%3Butm_medium=RSS","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13565"},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://support.f5.com/csp/article/K98008862?utm_source=f5support\u0026amp;utm_medium=RSS"},{"url":"https://usn.ubuntu.com/4078-2"},{"url":"https://usn.ubuntu.com/4078-1"},{"url":"https://github.com/advisories/GHSA-49q9-mmpr-r526"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-13565","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-13565","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1777310722.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1777393215.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13565","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0280.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25286","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192390-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1143194","tags":["report"]},{"url":"https://bugzilla.suse.com/1143273","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13565","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192395-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1073313","tags":["report"]},{"url":"https://bugzilla.suse.com/1111388","tags":["report"]},{"url":"https://bugzilla.suse.com/1114845","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17740","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201210-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1170771","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12243","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014353-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-13565","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4078-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4078-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13565","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13057","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/46KFS6OC36UWKEJS7D2YUROL2323KWEB/#46KFS6OC36UWKEJS7D2YUROL2323KWEB","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TQYMYQN54XQCPQJJZEIGGCBW3W7U53IW/#TQYMYQN54XQCPQJJZEIGGCBW3W7U53IW","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8027","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-13565","description":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.","status":"published","published":"2019-07-26T12:30:58Z","modified":"2026-10-14T06:50:05.228Z","updated_at":"2026-11-02T14:20:24.357095Z"}],"euvd":[{"id":"EUVD-2019-5020","description":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.","status":"published","published":"2019-07-26T12:30:58Z","modified":"2026-10-14T06:50:05Z","updated_at":"2026-11-02T17:27:17.374818Z"}],"ghsa":[{"id":"GHSA-49q9-mmpr-r526","title":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session...","description":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.","status":"published","published":"2022-05-24T16:51:30Z","modified":"2026-10-14T09:32:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:13:23.530725Z"}],"nvd":[{"id":"CVE-2019-13565","description":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.","status":"published","published":"2019-07-26T13:15:12.72Z","modified":"2026-10-14T07:16:46.353Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"ALPINE-CVE-2019-13565","description":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.","status":"published","published":"2019-07-26T13:15:12.72Z","modified":"2026-09-21T06:17:52.481529254Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-13565","title":"CVE-2019-13565 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:45.803869Z","modified":"2026-03-05T07:15:19.163795Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-13565","description":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.","status":"published","published":"2019-07-26T13:15:12.72Z","modified":"2026-11-02T02:45:55.248733427Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-13565","description":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.","status":"published","published":"2019-07-26T13:15:12.72Z","modified":"2026-10-15T07:47:32.314700439Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-13565","description":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.","status":"published","published":"2019-07-26T00:00:00Z","modified":"2026-04-22T12:10:21.453347Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"CLSA-2026-1777310722","title":"openldap: Fix of 15 CVEs","description":"- CVE-2019-13565: SASL session encryption SSF not reset on new connection, allowing downgrade\n- CVE-2020-12243: slapd crash via deeply nested LDAP search filter boolean expressions\n- CVE-2020-25692: NULL pointer dereference in slapd during modRDN request\n- CVE-2020-25709: slapd assertion failure via crafted certificate list validation\n- CVE-2020-25710: slapd assertion failure in obsolete csnNormalize23\n- CVE-2020-36221: slapd integer underflow crash in Certificate Exact Assertion processing\n- CVE-2020-36222: slapd assertion failure in saslAuthzTo validation\n- CVE-2020-36223: slapd double free crash in Values Return Filter control handling\n- CVE-2020-36224: slapd invalid pointer free and crash in saslAuthzTo processing\n- CVE-2020-36225: slapd double free crash in saslAuthzTo processing\n- CVE-2020-36226: slapd memch-\u003ebv_len miscalculation and crash in saslAuthzTo processing\n- CVE-2020-36227: slapd infinite loop via cancel_extop Cancel operation\n- CVE-2020-36228: slapd integer underflow crash in Certificate List Exact Assertion processing\n- CVE-2020-36229: slapd crash in X.509 DN parsing ad_keystring via ldap_X509dn2bv\n- CVE-2020-36230: slapd assertion failure in X.509 DN parsing ber_next_element in decode.c","status":"published","published":"2026-04-27T17:25:27Z","modified":"2026-06-01T00:33:23.608317789Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777393215","title":"openldap: Fix of 15 CVEs","description":"- CVE-2019-13565: SASL session encryption SSF not reset on new connection, allowing downgrade\n- CVE-2020-12243: slapd crash via deeply nested LDAP search filter boolean expressions\n- CVE-2020-25692: NULL pointer dereference in slapd during modRDN request\n- CVE-2020-25709: slapd assertion failure via crafted certificate list validation\n- CVE-2020-25710: slapd assertion failure in obsolete csnNormalize23\n- CVE-2020-36221: slapd integer underflow crash in Certificate Exact Assertion processing\n- CVE-2020-36222: slapd assertion failure in saslAuthzTo validation\n- CVE-2020-36223: slapd double free crash in Values Return Filter control handling\n- CVE-2020-36224: slapd invalid pointer free and crash in saslAuthzTo processing\n- CVE-2020-36225: slapd double free crash in saslAuthzTo processing\n- CVE-2020-36226: slapd memch-\u003ebv_len miscalculation and crash in saslAuthzTo processing\n- CVE-2020-36227: slapd infinite loop via cancel_extop Cancel operation\n- CVE-2020-36228: slapd integer underflow crash in Certificate List Exact Assertion processing\n- CVE-2020-36229: slapd crash in X.509 DN parsing ad_keystring via ldap_X509dn2bv\n- CVE-2020-36230: slapd assertion failure in X.509 DN parsing ber_next_element in decode.c","status":"published","published":"2026-04-28T16:20:21Z","modified":"2026-06-01T00:33:12.568365854Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"DLA-1891-1","title":"openldap - security update","status":"published","published":"2019-08-18T00:00:00Z","modified":"2026-03-09T01:21:02.463851Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2019-0280","title":"Updated openldap packages fix security vulnerabilities","description":"Updated openldap packages fix security vulnerabilities:\nIt was discovered that OpenLDAP incorrectly handled rootDN delegation.\nA database administrator could use this issue to request authorization\nas an identity from another database, contrary to expectations\n(CVE-2019-13057).\n\nIt was discovered that OpenLDAP incorrectly handled SASL authentication\nand session encryption. After a first SASL bind was completed, it was\npossible to obtain access by performing simple binds, contrary to\nexpectations (CVE-2019-13565).\n","status":"published","published":"2019-09-15T14:45:31Z","modified":"2026-04-16T04:44:23.680970082Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:2157-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194).\n- CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273).\n- CVE-2017-17740: When both the nops module and the member of overlay\n  are enabled, attempts to free a buffer that was allocated on the stack,\n  which allows remote attackers to cause a denial of service (slapd crash)\n  via a member MODDN operation. (bsc#1073313)\n\nNon-security issues fixed:\n\n- Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845).\n- Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388)\n- Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-23T18:19:38Z","modified":"2026-02-04T03:01:08.357746Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2176-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194).\n- CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273).\n- CVE-2017-17740: When both the nops module and the member of overlay\n  are enabled, attempts to free a buffer that was allocated on the stack,\n  which allows remote attackers to cause a denial of service (slapd crash)\n  via a member MODDN operation. (bsc#1073313)\n\nNon-security issues fixed:\n\n- Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845).\n- Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388)\n- Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-24T08:20:38Z","modified":"2026-02-04T02:59:45.283421Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11121-1","title":"libldap-2_4-2-2.4.59-69.3 on GA media","description":"These are all security issues fixed in the libldap-2_4-2-2.4.59-69.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:12:22.368649Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:2390-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-13565: Fixed ssf memory reuse that leads to incorrect authorization of another connection, granting excess connection rights (ssf) (bsc#1143194).\n- CVE-2019-13057: Fixed rootDN of a backend that may proxyauth incorrectly to another backend, violating multi-tenant isolation (bsc#1143273).\n","status":"published","published":"2019-09-17T13:46:09Z","modified":"2026-02-04T04:05:49.7692Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2395-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194).\n- CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273).\n- CVE-2017-17740: When both the nops module and the member of overlay\n  are enabled, attempts to free a buffer that was allocated on the stack,\n  which allows remote attackers to cause a denial of service (slapd crash)\n  via a member MODDN operation. (bsc#1073313)\n\nNon-security issues fixed:\n\n- Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845).\n- Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388)\n- Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).\n","status":"published","published":"2019-09-18T06:31:55Z","modified":"2026-02-04T04:21:30.820036Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2020:1210-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\n- CVE-2020-12243: Fixed a denial of service related to recursive filters (bsc#1170771).\n- CVE-2019-13565: Fixed an authentication bypass caused by incorrect authorization of another connection, granting excess connection rights (bsc#1143194).\n- CVE-2019-13057: Fixed an issue with improper authorization with delegated database admin privileges (bsc#1143273).\n","status":"published","published":"2020-05-07T08:38:25Z","modified":"2026-02-04T04:39:44.568845Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:14353-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\n- CVE-2019-13565: Fixed an authentication bypass caused by incorrect authorization of another connection, granting excess connection rights (bsc#1143194).\n- CVE-2019-13057: Fixed an issue with improper authorization with delegated database admin privileges (bsc#1143273).\n","status":"published","published":"2020-04-29T20:55:45Z","modified":"2026-02-04T04:00:06.001384Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4078-1","title":"openldap vulnerabilities","description":"It was discovered that OpenLDAP incorrectly handled rootDN delegation. A\ndatabase administrator could use this issue to request authorization as an\nidentity from another database, contrary to expectations. (CVE-2019-13057)\n\nIt was discovered that OpenLDAP incorrectly handled SASL authentication and\nsession encryption. After a first SASL bind was completed, it was possible\nto obtain access by performing simple binds, contrary to expectations.\n(CVE-2019-13565)\n","status":"published","published":"2019-07-30T16:50:18Z","modified":"2026-04-22T09:59:29.209239Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4078-2","title":"openldap vulnerabilities","description":"USN-4078-1 fixed several vulnerabilities in openldap. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that OpenLDAP incorrectly handled rootDN delegation. A\n database administrator could use this issue to request authorization as an\n identity from another database, contrary to expectations. (CVE-2019-13057)\n\n It was discovered that OpenLDAP incorrectly handled SASL authentication and\n session encryption. After a first SASL bind was completed, it was possible\n to obtain access by performing simple binds, contrary to expectations.\n (CVE-2019-13565)\n","status":"published","published":"2019-08-19T13:12:55Z","modified":"2026-04-22T09:58:39.413789Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}