CVE-2019-13565
An issue was discovered in OpenLDAP 2.x before 2.4.48.
Published Jul 26, 2019 · updated Oct 14, 2026 · openldap openldap
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.
Timeline
Detection, updates, and resolution for this record.
Jul 26, 2019 · NIST NVD
Detected
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections
Oct 14, 2026 · NIST NVD
Updated
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections
Affected
- cpe apple/mac os xversion unspecified
- cpe canonical/ubuntu linux12.04
- cpe canonical/ubuntu linux14.04
- cpe canonical/ubuntu linux16.04
- cpe canonical/ubuntu linux18.04
- cpe canonical/ubuntu linux19.04
- cpe debian/debian linux8.0
- cpe f5/traffix signaling delivery controller5.0.0
- cpe openldap/openldapversion unspecified
- cpe opensuse/leap15.0
- cpe oracle/blockchain platformversion unspecified
Sources
- NIST NVDCVE-2019-13565
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covere
nvd.nist.gov