An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)
{ "vanir_signatures": [ { "id": "CVE-2019-13057-8d670119", "signature_type": "Function", "digest": { "function_hash": "81063690992040781467550700777675779130", "length": 6455.0 }, "target": { "file": "libraries/libldap/cyrus.c", "function": "ldap_int_sasl_bind" }, "deprecated": false, "signature_version": "v1", "source": "https://github.com/openldap/openldap/commit/1f25fbc9b92823540db460b7618988d3feafbc50" }, { "id": "CVE-2019-13057-93261e78", "signature_type": "Line", "digest": { "line_hashes": [ "312627585656422542698671092433723073376", "338667210732090488210469566781984538516", "174272373029822939739738495638263106988", "73299445739927031031918352608744476866", "79328900896938706329537600223240551847", "19630966697333832462434547331236633149", "215322681832582147462375593403124087236", "237705069010983046172293202720829508463", "138915725995887299269478284513847673777", "102423115331596487121742125187167279873", "16320344604405346819738529550927297199", "202584951158536821866804847025545586148" ], "threshold": 0.9 }, "target": { "file": "libraries/libldap/cyrus.c" }, "deprecated": false, "signature_version": "v1", "source": "https://github.com/openldap/openldap/commit/1f25fbc9b92823540db460b7618988d3feafbc50" } ] }