NetSight
IP …
high7.5

CVE-2019-19906

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet.

Impact

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.

Affected products

VendorProductAffected versions
CyrusimapCyrus-Sasl
before 2.1.28
DebianDebian Linux
Versions 8.0, 9.0, 10.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04, 19.10
FedoraprojectFedora
Versions 31, 32
RedhatJboss Enterprise Web Server
Version 2.0.0
AppleMac Os X
before 10.13.6
from 10.13.0 before 10.13.6
from 10.15.0 before 10.15.6
Versions 10.14.6, 10.13.6
RedhatEnterprise Linux
Versions 5.0, 6.0, 7.0, 8.0
RedhatEnterprise Linux Eus
Version 8.4
RedhatEnterprise Linux For Ibm Z Systems
Version 8.0
RedhatEnterprise Linux For Ibm Z Systems Eus
Version 8.4
RedhatEnterprise Linux For Power Little Endian
Version 8.0
RedhatEnterprise Linux For Power Little Endian Eus
Version 8.4

Weakness classification

CWE-193CWE-787

References