CVE-2019-13057
- State
- Published
- Severity
- Not scored
- Published
- Jul 26, 2019
- Updated
- Oct 14, 2026
- Reserved
- Jun 29, 2019
Description
An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- USN-4078-1vendor-advisory
- [debian-lts-announce] 20190818 [SECURITY] [DLA 1891-1] openldap security updatemailing-list
- USN-4078-2vendor-advisory
- openSUSE-SU-2019:2157vendor-advisory
- openSUSE-SU-2019:2176vendor-advisory
- 20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierramailing-list
- 20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierramailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://support.apple.com/kb/HT210788
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
- https://www.openldap.org/its/?findid=9038
- https://www.openldap.org/lists/openldap-announce/201907/msg00001.html
- https://security.netapp.com/advisory/ntap-20190822-0004/
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.