openldap: ACL restrictions bypass due to sasl_ssf value being set permanently
Published Jul 26, 2019
7.5
HIGHCVSS 3.1
EPSS 5.01%
Description
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.
Affected products
No data.
Configuration 2
- 12.04
- 14.04
- 16.04
- 18.04
- 19.04
Configuration 3
- 8.0
Configuration 5
- 5.0.0
- 5.1.0
Configuration 6
- ≥ 10.13 · < 10.13.6
- ≥ 10.14 · < 10.14.6
- ≥ 10.15 · < 10.15.2
- 10.13.6
- 10.13.6
- 10.13.6
- 10.13.6
- 10.13.6
- 10.13.6
- 10.13.6
- 10.13.6
- 10.13.6
- 10.13.6
- 10.14.6
- 10.14.6
Configuration 7
- < 21.1.2
- 8.8
- 11
No data.
Red Hat Enterprise Linux 5
openldap
Out of support scope
Red Hat Enterprise Linux 6
compat-openldap
Not affected
Red Hat Enterprise Linux 6
openldap
Out of support scope
Red Hat Enterprise Linux 7
compat-openldap
Not affected
Red Hat Enterprise Linux 7
openldap
Will not fix
Red Hat Enterprise Linux 8
openldap
Not affected
Red Hat JBoss Core Services
openldap
Out of support scope
Red Hat JBoss Enterprise Application Platform 5
openldap
Out of support scope
Red Hat JBoss Enterprise Web Server 2
openldap
Out of support scope
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 5 | openldap | Out of support scope | n/a |
| Red Hat Enterprise Linux 6 | compat-openldap | Not affected | n/a |
| Red Hat Enterprise Linux 6 | openldap | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | compat-openldap | Not affected | n/a |
| Red Hat Enterprise Linux 7 | openldap | Will not fix | n/a |
| Red Hat Enterprise Linux 8 | openldap | Not affected | n/a |
| Red Hat JBoss Core Services | openldap | Out of support scope | n/a |
| Red Hat JBoss Enterprise Application Platform 5 | openldap | Out of support scope | n/a |
| Red Hat JBoss Enterprise Web Server 2 | openldap | Out of support scope | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This issue did not affect the versions of openldap as shipped with Red Hat Enterprise Linux 8, as it only affects the openldap-servers package, which is not shipped.
References (22)
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2019/Dec/26 mailing-listx_refsource_FULLDISCMailing ListThird Party Advisory
- http://www.openldap.org/lists/openldap-announce/201907/msg00001.html
- https://access.redhat.com/security/cve/CVE-2019-13565 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1730477 Issue Tracking
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-13565
- https://openldap.org/its/?findid=9052
- https://seclists.org/bugtraq/2019/Dec/23 mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory
- https://support.apple.com/kb/HT210788 x_refsource_CONFIRMThird Party Advisory
- https://support.f5.com/csp/article/K98008862?utm_source=f5support&%3Butm_medium=RSS x_refsource_CONFIRM
- https://usn.ubuntu.com/4078-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/4078-2/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-13565
- https://www.openldap.org/its/index.cgi/?findid=9052 x_refsource_MISCMailing ListVendor Advisory
- https://www.openldap.org/lists/openldap-announce/201907/msg00001.html x_refsource_CONFIRMMailing ListVendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISCPatchThird Party Advisory
Change history (0)
No recorded changes yet.