{"id":"CVE-2019-13565","details":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.","modified":"2026-07-28T04:01:20.396019707Z","published":"2019-07-26T13:15:12.720Z","related":["SUSE-SU-2019:2390-1","SUSE-SU-2019:2395-1","SUSE-SU-2020:1210-1","SUSE-SU-2020:14353-1","openSUSE-SU-2019:2157-1","openSUSE-SU-2019:2176-1","openSUSE-SU-2024:11121-1"],"database_specific":{"unresolved_ranges":[{"source":"CPE_RANGE","vendor_product":"apple:mac_os_x","cpes":["cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"10.13"},{"fixed":"10.13.6"},{"introduced":"10.14"},{"fixed":"10.14.6"},{"introduced":"10.15"},{"fixed":"10.15.2"}]},{"source":"CPE_RANGE","vendor_product":"oracle:blockchain_platform","cpes":["cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"21.1.2"}]},{"extracted_events":[{"introduced":"10.13.6"},{"last_affected":"10.13.6"},{"introduced":"10.13.6-NA"},{"last_affected":"10.13.6-NA"},{"introduced":"10.13.6-security_update_2018\\-002"},{"last_affected":"10.13.6-security_update_2018\\-002"},{"introduced":"10.13.6-security_update_2018\\-003"},{"last_affected":"10.13.6-security_update_2018\\-003"},{"introduced":"10.13.6-security_update_2019\\-001"},{"last_affected":"10.13.6-security_update_2019\\-001"},{"introduced":"10.13.6-security_update_2019\\-002"},{"last_affected":"10.13.6-security_update_2019\\-002"},{"introduced":"10.13.6-security_update_2019\\-003"},{"last_affected":"10.13.6-security_update_2019\\-003"},{"introduced":"10.13.6-security_update_2019\\-004"},{"last_affected":"10.13.6-security_update_2019\\-004"},{"introduced":"10.13.6-security_update_2019\\-005"},{"last_affected":"10.13.6-security_update_2019\\-005"},{"introduced":"10.13.6-security_update_2019\\-006"},{"last_affected":"10.13.6-security_update_2019\\-006"},{"introduced":"10.14.6-NA"},{"last_affected":"10.14.6-NA"},{"introduced":"10.14.6-security_update_2019\\-001"},{"last_affected":"10.14.6-security_update_2019\\-001"}],"source":"CPE_STRING","vendor_product":"apple:mac_os_x","cpes":["cpe:2.3:o:apple:mac_os_x:10.13.6:*:*:*:*:*:*:*","cpe:2.3:o:apple:mac_os_x:10.13.6:-:*:*:*:*:*:*","cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*","cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*","cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*","cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:*","cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:*","cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:*","cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-005:*:*:*:*:*:*","cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-006:*:*:*:*:*:*","cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*","cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:*:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.04"},{"last_affected":"12.04"},{"introduced":"14.04"},{"last_affected":"14.04"},{"introduced":"16.04"},{"last_affected":"16.04"},{"introduced":"18.04"},{"last_affected":"18.04"},{"introduced":"19.04"},{"last_affected":"19.04"}],"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux"},{"vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING"},{"vendor_product":"f5:traffix_signaling_delivery_controller","cpes":["cpe:2.3:a:f5:traffix_signaling_delivery_controller:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:f5:traffix_signaling_delivery_controller:5.1.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.0.0"},{"last_affected":"5.0.0"},{"introduced":"5.1.0"},{"last_affected":"5.1.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","vendor_product":"opensuse:leap","cpes":["cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*","cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"15.0"},{"last_affected":"15.0"},{"introduced":"15.1"},{"last_affected":"15.1"}]},{"source":"CPE_STRING","vendor_product":"oracle:solaris","cpes":["cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"11"},{"last_affected":"11"}]},{"source":"CPE_STRING","vendor_product":"oracle:zfs_storage_appliance_kit","cpes":["cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.8"},{"last_affected":"8.8"}]}]},"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"},{"type":"WEB","url":"https://support.f5.com/csp/article/K98008862?utm_source=f5support&amp%3Butm_medium=RSS"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html"},{"type":"ADVISORY","url":"http://seclists.org/fulldisclosure/2019/Dec/26"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html"},{"type":"ADVISORY","url":"https://seclists.org/bugtraq/2019/Dec/23"},{"type":"ADVISORY","url":"https://support.apple.com/kb/HT210788"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4078-1/"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4078-2/"},{"type":"ADVISORY","url":"https://www.openldap.org/its/index.cgi/?findid=9052"},{"type":"ADVISORY","url":"https://www.openldap.org/lists/openldap-announce/201907/msg00001.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.openldap.org/openldap/openldap","events":[{"introduced":"9794f9fbe87267e8323c44a260abd2656d1652e7"},{"last_affected":"e736c44a7c6a83bb03e52fa9c7dbddb71bf9eeaf"}],"database_specific":{"extracted_events":[{"introduced":"2.0"},{"last_affected":"2.4.47"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-13565.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/openldap/openldap","events":[{"introduced":"9794f9fbe87267e8323c44a260abd2656d1652e7"},{"last_affected":"e736c44a7c6a83bb03e52fa9c7dbddb71bf9eeaf"}],"database_specific":{"cpe":"cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.0"},{"last_affected":"2.4.47"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-13565.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}