PT-2019-2907 · Openldap+3 · Openldap+3

Published 2019-07-26 · Updated 2025-01-13 · CVE-2019-13565

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenLDAP versions prior to 2.4.48

Description An issue in OpenLDAP allows access that would otherwise be denied via a simple bind for any identity covered in the ACLs when using SASL authentication and session encryption. After the first SASL bind is completed, the sasl ssf value is retained for all new non-SASL connections, affecting different types of operations depending on the ACL configuration. This means a successful authorization step completed by one user can affect the authorization requirement for a different user.

Recommendations For OpenLDAP versions prior to 2.4.48, update to version 2.4.48 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive operations until the update is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2019-2556

ALT-PU-2019-2568

BDU:2019-02876

CVE-2019-13565

DLA-1891-1

MGASA-2019-0280

OPENSUSE-SU-2019:2157-1

OPENSUSE-SU-2019:2176-1

OPENSUSE-SU-2019_2157-1

OPENSUSE-SU-2019_2176-1

OPENSUSE-SU-2024:11121-1

ROSA-SA-2025-2550

SUSE-SU-2019:2390-1

SUSE-SU-2019:2395-1

SUSE-SU-2020:1210-1

SUSE-SU-2020:14353-1

USN-4078-1

USN-4078-2

Affected Products

Alt Linux

Openldap

Suse

Ubuntu

References · 63

• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://osv.dev/vulnerability/USN-4078-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-13565 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-13565 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1210-1 · Vendor Advisory
• https://openldap.org/lists/openldap-announce/201907/msg00001.html · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2157-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4078-2 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2390-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-13565 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-13565 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2176-1 · Vendor Advisory