CVE-2019-13057
First published: Fri Jul 26 2019(Updated: )
An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)
Credit: CVE-2012-1164 CVE-2012-2668 CVE-2013-4449 CVE-2015-1545 CVE-2019-13057 CVE-2019-13565 cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/openldap | 2.4.57+dfsg-3+deb11u1 2.5.13+dfsg-5 2.5.18+dfsg-3 | |
| macOS Catalina | <10.15.2 | 10.15.2 |
| macOS Mojave | ||
| macOS High Sierra | ||
| OpenLDAP | <2.4.48 | |
| Ubuntu | =12.04 | |
| Ubuntu | =14.04 | |
| Ubuntu | =16.04 | |
| Ubuntu | =18.04 | |
| Ubuntu | =19.04 | |
| Debian | =8.0 | |
| openSUSE | =15.0 | |
| openSUSE | =15.1 | |
| Apple iOS and macOS | >=10.13<10.13.6 | |
| Apple iOS and macOS | >=10.14<10.14.6 | |
| Apple iOS and macOS | >=10.15<10.15.2 | |
| Apple iOS and macOS | =10.13.6 | |
| Apple iOS and macOS | =10.13.6-security_update_2018-002 | |
| Apple iOS and macOS | =10.13.6-security_update_2018-003 | |
| Apple iOS and macOS | =10.13.6-security_update_2019-001 | |
| Apple iOS and macOS | =10.13.6-security_update_2019-002 | |
| Apple iOS and macOS | =10.13.6-security_update_2019-003 | |
| Apple iOS and macOS | =10.13.6-security_update_2019-004 | |
| Apple iOS and macOS | =10.13.6-security_update_2019-005 | |
| Apple iOS and macOS | =10.13.6-security_update_2019-006 | |
| Apple iOS and macOS | =10.14.6 | |
| Apple iOS and macOS | =10.14.6 | |
| Apple iOS and macOS | =10.14.6-security_update_2019-001 | |
| McAfee Policy Auditor | <6.5.1 | |
| McAfee Policy Auditor | =6.5.1 | |
| oracle blockchain platform | <21.1.2 | |
| Oracle Sun ZFS Storage Appliance Kit | =8.8 | |
| Oracle Solaris SPARC | =11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
- https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html
- https://seclists.org/bugtraq/2019/Dec/23
- https://security.netapp.com/advisory/ntap-20190822-0004/
- https://support.apple.com/kb/HT210788
- https://usn.ubuntu.com/4078-1/
- https://usn.ubuntu.com/4078-2/
- https://www.openldap.org/its/?findid=9038
- https://www.openldap.org/lists/openldap-announce/201907/msg00001.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
- https://launchpad.net/bugs/cve/CVE-2019-13057
- https://support.apple.com/en-us/HT210788 (Advisory)
- https://openldap.org/its/?findid=9038
- https://security-tracker.debian.org/tracker/CVE-2019-13057
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13057
- https://nvd.nist.gov/vuln/detail/CVE-2019-13057
- https://ubuntu.com/security/CVE-2019-13057
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2019-8837
- CVE-2019-8853
- CVE-2019-8856
- CVE-2019-8848
- CVE-2019-8834
- CVE-2019-8842
- CVE-2019-8839
- CVE-2019-8830
- CVE-2019-8851
- CVE-2019-8833
- CVE-2019-8828
- CVE-2019-8838
- CVE-2019-8847
- CVE-2019-8852
- CVE-2019-15903
- CVE-2020-9782
- CVE-2012-1164
- CVE-2012-2668
- CVE-2013-4449
- CVE-2015-1545
- CVE-2019-13057
- CVE-2019-13565
- CVE-2019-8832
- CVE-2017-16808
- CVE-2018-10103
- CVE-2018-10105
- CVE-2018-14461
- CVE-2018-14462
- CVE-2018-14463
- CVE-2018-14464
- CVE-2018-14465
- CVE-2018-14466
- CVE-2018-14467
- CVE-2018-14468
- CVE-2018-14469
- CVE-2018-14470
- CVE-2018-14879
- CVE-2018-14880
- CVE-2018-14881
- CVE-2018-14882
- CVE-2018-16227
- CVE-2018-16228
- CVE-2018-16229
- CVE-2018-16230
- CVE-2018-16300
- CVE-2018-16301
- CVE-2018-16451
- CVE-2018-16452
- CVE-2019-15166
- CVE-2019-15167
- CVE-2019-15126
Frequently Asked Questions
What is CVE-2019-13057?
CVE-2019-13057 is a vulnerability in OpenLDAP that was addressed in version 2.4.28.
How does CVE-2019-13057 affect macOS Catalina?
macOS Catalina 10.15.2 is affected by CVE-2019-13057, but updating to version 2.4.28 of OpenLDAP resolves the issue.
Is Mojave affected by CVE-2019-13057?
Yes, macOS Mojave is affected by CVE-2019-13057, and updating OpenLDAP to version 2.4.28 is recommended.
What about High Sierra? Is it affected by CVE-2019-13057?
Yes, macOS High Sierra is also affected by CVE-2019-13057, and updating OpenLDAP to version 2.4.28 is recommended.
Where can I find more information about CVE-2019-13057?
You can find more information about CVE-2019-13057 at the following reference: [Apple Support](https://support.apple.com/en-us/HT210788)
- collector/launchpad-cve
- source/Launchpad
- agent/type
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/remedy
- agent/event
- agent/description
- agent/first-publish-date
- agent/trending
- agent/source
- agent/author
- collector/apple-support
- alias/CVE-2012-2668
- alias/CVE-2013-4449
- alias/CVE-2015-1545
- alias/CVE-2019-13057
- alias/CVE-2019-13565
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- package-manager/debian
- vendor/apple
- canonical/macos catalina
- canonical/macos mojave
- canonical/macos high sierra
- vendor/openldap
- canonical/openldap
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/12.04
- version/ubuntu/14.04
- version/ubuntu/16.04
- version/ubuntu/18.04
- version/ubuntu/19.04
- vendor/debian
- canonical/debian
- version/debian/8.0
- vendor/opensuse
- canonical/opensuse
- version/opensuse/15.0
- version/opensuse/15.1
- canonical/apple ios and macos
- version/apple ios and macos/10.13
- version/apple ios and macos/10.14
- version/apple ios and macos/10.15
- version/apple ios and macos/10.13.6
- version/apple ios and macos/10.13.6-security_update_2018-002
- version/apple ios and macos/10.13.6-security_update_2018-003
- version/apple ios and macos/10.13.6-security_update_2019-001
- version/apple ios and macos/10.13.6-security_update_2019-002
- version/apple ios and macos/10.13.6-security_update_2019-003
- version/apple ios and macos/10.13.6-security_update_2019-004
- version/apple ios and macos/10.13.6-security_update_2019-005
- version/apple ios and macos/10.13.6-security_update_2019-006
- version/apple ios and macos/10.14.6
- version/apple ios and macos/10.14.6-security_update_2019-001
- vendor/mcafee
- canonical/mcafee policy auditor
- version/mcafee policy auditor/6.5.1
- vendor/oracle
- canonical/oracle blockchain platform
- canonical/oracle sun zfs storage appliance kit
- version/oracle sun zfs storage appliance kit/8.8
- canonical/oracle solaris sparc
- version/oracle solaris sparc/11