Medium severity4.9NVD Advisory· Published Jul 26, 2019· Updated Jun 17, 2026

CVE-2019-13057

Description

An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

McAfee/Policy Auditor2 versions
cpe:2.3:a:mcafee:policy_auditor:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mcafee:policy_auditor:*:*:*:*:*:*:*:*range: <6.5.1
- cpe:2.3:a:mcafee:policy_auditor:6.5.1:*:*:*:*:*:*:*
OpenLDAP/Openldap2 versions
cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*range: <2.4.48
- (no CPE)range: <2.4.48
Oracle Corporation/Blockchain Platform
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
Range: <21.1.2
Oracle Corporation/Zfs Storage Appliance Kit
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
Apple Inc./Mac OS X13 versions
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*+ 12 more
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*range: >=10.13,<10.13.6
- cpe:2.3:o:apple:mac_os_x:10.13.6:-:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-005:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-006:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.14.6:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
Canonical/Ubuntu Linux5 versions
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*+ 4 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
Debian/linux
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
OpenSUSE/Leap2 versions
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Oracle Corporation/Solaris
cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*
OpenLDAP/OpenLDAPdescription
osv-coords21 versions
pkg:rpm/opensuse/openldap2&distro=openSUSE%20Leap%2015.0 pkg:rpm/opensuse/openldap2&distro=openSUSE%20Leap%2015.1 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP1 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2012 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP1 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/openldap2-client&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/openldap2-client&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/openldap2-client-openssl1&distro=SUSE%20Linux%20Enterprise%20Server%2011-SECURITY
< 2.4.46-lp150.13.1+ 20 more
- (no CPE)range: < 2.4.46-lp150.13.1
- (no CPE)range: < 2.4.46-lp151.10.3.1
- (no CPE)range: < 2.4.41-18.63.1
- (no CPE)range: < 2.4.46-9.19.2
- (no CPE)range: < 2.4.46-9.19.2
- (no CPE)range: < 2.4.46-9.19.2
- (no CPE)range: < 2.4.46-9.19.2
- (no CPE)range: < 2.4.41-18.24.17.1
- (no CPE)range: < 2.4.46-9.19.2
- (no CPE)range: < 2.4.46-9.19.2
- (no CPE)range: < 2.4.41-18.24.17.1
- (no CPE)range: < 2.4.41-18.63.1
- (no CPE)range: < 2.4.41-18.24.17.1
- (no CPE)range: < 2.4.41-18.24.17.1
- (no CPE)range: < 2.4.41-18.24.17.1
- (no CPE)range: < 2.4.41-18.63.1
- (no CPE)range: < 2.4.41-18.24.17.1
- (no CPE)range: < 2.4.41-18.63.1
- (no CPE)range: < 2.4.41-18.24.17.1
- (no CPE)range: < 2.4.41-18.24.17.1
- (no CPE)range: < 2.4.26-0.74.6.1

Patches

Vulnerability mechanics

References

www.oracle.com/security-alerts/cpuapr2020.htmlnvdPatchThird Party Advisory
www.oracle.com/security-alerts/cpuapr2022.htmlnvdPatchThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.htmlnvdMailing ListThird Party Advisory
seclists.org/fulldisclosure/2019/Dec/26nvdMailing ListThird Party Advisory
kc.mcafee.com/corporate/indexnvdThird Party Advisory
lists.debian.org/debian-lts-announce/2019/08/msg00024.htmlnvdMailing ListThird Party Advisory
seclists.org/bugtraq/2019/Dec/23nvdMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20190822-0004/nvdThird Party Advisory
support.apple.com/kb/HT210788nvdThird Party Advisory
usn.ubuntu.com/4078-1/nvdThird Party Advisory
usn.ubuntu.com/4078-2/nvdThird Party Advisory
www.openldap.org/its/nvdMailing ListVendor Advisory
www.openldap.org/lists/openldap-announce/201907/msg00001.htmlnvdMailing ListProductVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.319
epss	0.003
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000