PT-2019-4149 · Openldap+3 · Openldap+3

Published 2019-07-26 · Updated 2025-01-13 · CVE-2019-13057

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:N/AC:M/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenLDAP versions prior to 2.4.48

Description An issue in the server allows a rootDN to request authorization as an identity from another database during a SASL bind or with a proxyAuthz control, potentially leading to information disclosure. This issue is particularly relevant in multi-tenant deployments where database isolation is desired.

Recommendations For versions prior to 2.4.48, update to version 2.4.48 or later to resolve the issue. As a temporary workaround, consider restricting the use of the proxyAuthz control and ensuring proper configuration of rootDN privileges to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2019-2556

ALT-PU-2019-2568

BDU:2019-04729

CVE-2019-13057

DLA-1891-1

MGASA-2019-0280

OPENSUSE-SU-2019:2157-1

OPENSUSE-SU-2019:2176-1

OPENSUSE-SU-2019_2157-1

OPENSUSE-SU-2019_2176-1

OPENSUSE-SU-2024:11121-1

ROSA-SA-2025-2550

SUSE-SU-2019:2390-1

SUSE-SU-2019:2395-1

SUSE-SU-2019_2390-1

SUSE-SU-2020:1210-1

SUSE-SU-2020:14353-1

SUSE-SU-2020_1210-1

SUSE-SU-2020_14353-1

USN-4078-1

USN-4078-2

Affected Products

Alt Linux

Openldap

Suse

Ubuntu

References · 110

• https://ubuntu.com/security/CVE-2019-13565 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1891-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4078-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-2568 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13057 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/685432 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:2390-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04729 · Security Note
• https://openldap.org/its/?findid=9038 · Vendor Advisory
• https://openldap.org/lists/openldap-announce/201907/msg00001.html · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2019:2157-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0280.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36223 · Security Note
• https://bdu.fstec.ru/vul/2021-06403 · Security Note