Improper Authorization in OpenLDAP - CVE-2019-13057
Published: July 30, 2019
Vulnerability identifier: #VU19561
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-13057
CWE-ID: CWE-285
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to incorrect processing of rootDN delegation in the OpenLDAP multi-tenant deployments. A database administrator could use this issue to request authorization as an identity from another database, contrary to expectations.
Affected software
OpenLDAP
Splunk Enterprise
Opensuse
Ubuntu
openldap (Alpine package)
slapd (Ubuntu package)
Splunk Enterprise
Opensuse
Ubuntu
openldap (Alpine package)
slapd (Ubuntu package)
How to mitigate CVE-2019-13057
Install updates from vendor's website.
OpenLDAP - update to 2.4.48
Splunk Enterprise - addressed in versions 9.1.6, 9.2.3, 9.3.1
openldap (Alpine package) - addressed in versions 2.4.48-r0, 2.4.48-r2
slapd (Ubuntu package) - addressed in versions 2.4.42+dfsg-2ubuntu3.6, 2.4.45+dfsg-1ubuntu1.3, 2.4.47+dfsg-3ubuntu2.1
Splunk Enterprise - addressed in versions 9.1.6, 9.2.3, 9.3.1
openldap (Alpine package) - addressed in versions 2.4.48-r0, 2.4.48-r2
slapd (Ubuntu package) - addressed in versions 2.4.42+dfsg-2ubuntu3.6, 2.4.45+dfsg-1ubuntu1.3, 2.4.47+dfsg-3ubuntu2.1