Back to Database
Status published
High
CVE-2019-19906
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading...
Vulnerability Description
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-19906
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/cyrusimap/cyrus-sasl/issues/587
- https://www.openldap.org/its/index.cgi/Incoming?id=9123
- https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html
- https://www.debian.org/security/2019/dsa-4591
- https://seclists.org/bugtraq/2019/Dec/42
- https://usn.ubuntu.com/4256-1/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/
- https://support.apple.com/kb/HT211288
- https://support.apple.com/kb/HT211289
- http://seclists.org/fulldisclosure/2020/Jul/24
- http://seclists.org/fulldisclosure/2020/Jul/23
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- http://www.openwall.com/lists/oss-security/2022/02/23/4
More from cyrusimap
View All →Affected Vendor
cyrusimap
View all reports →Affected Software
cyrus-sasl, debian linux, ubuntu linux, fedora, jboss enterprise web server, mac os x, enterprise linux, enterprise linux eus, enterprise linux for ibm z systems, enterprise linux for ibm z systems eus, enterprise linux for power little endian, enterprise linux for power little endian eus, enterprise linux server aus, enterprise linux server for power little endian update services for sap solutions, enterprise linux server tus, enterprise linux server update services for sap solutions, ipados, iphone os, bookkeeper
Vulnerable Versions:
0, 8.0, 9.0, 10.0, 12.04, 14.04, 16.04, 18.04, 19.10, 31, 32, 2.0.0, 10.14.6, 10.13.0, 10.15.0, 10.13.6, 5.0, 6.0, 7.0, 8.4, 13.6, 4.12.1
Timeline
Official Publish:
December 19th, 2019
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.