Out-of-bounds Write in OpenLDAP Affects Cyrus SASL Software by Cyrus
CVE-2019-19906

7.5HIGH

Key Information:

Vendor

Cyrusimap

Status
Cyrus-sasl
Vendor
CVE Published:
19 December 2019

What is CVE-2019-19906?

Cyrus SASL version 2.1.27 is susceptible to an out-of-bounds write vulnerability that can be exploited to cause an unauthenticated remote denial-of-service in OpenLDAP. This flaw is triggered when OpenLDAP receives a malformed LDAP packet, resulting in a crash due to an off-by-one error in the function _sasl_add_string. This vulnerability underscores the importance of applying timely updates and patches to safeguard systems against potential exploits.

References

https://github.com/cyrusimap/cyrus-sasl/issues/587
x_refsource_MISC
https://www.openldap.org/its/index.cgi/Incoming?id=9123
x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2019/12/msg0...
mailing-listx_refsource_MLIST

EPSS Score

8% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.