CVE-2019-19906

Published: Dec 19, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.

Affected (54)

Products: Cyrusimap: Cyrus Sasl · Debian: Debian Linux · Canonical: Ubuntu Linux · +4 more

Show all products

1 product

1 product

1 product

1 product

3 products

11 products

Enterprise Linux For Ibm Z Systems

Enterprise Linux For Ibm Z Systems Eus

Enterprise Linux For Power Little Endian

Enterprise Linux For Power Little Endian Eus

Enterprise Linux Server Aus

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions

Enterprise Linux Server Tus

Enterprise Linux Server Update Services For Sap Solutions

Jboss Enterprise Web Server

Apache

1 product

Bookkeeper

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cyrusimap Cyrus Sasl	Before 2.1.28

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.10

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32

Configuration E

15 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Version 10.14.6
Redhat Enterprise Linux	Version 5.0
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux Eus	Version 8.4
Redhat Enterprise Linux For Ibm Z Systems	Version 8.0
Redhat Enterprise Linux For Ibm Z Systems Eus	Version 8.4
Redhat Enterprise Linux For Power Little Endian	Version 8.0
Redhat Enterprise Linux For Power Little Endian Eus	Version 8.4
Redhat Enterprise Linux Server Aus	Version 8.4
Redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions	Version 8.4
Redhat Enterprise Linux Server Tus	Version 8.4
Redhat Enterprise Linux Server Update Services For Sap Solutions	Version 8.4
Redhat Jboss Enterprise Web Server	Version 2.0.0

Configuration F

27 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	Version 13.6
Apple Iphone Os	Version 13.6
Apple Mac Os X	Before 10.13.6
Apple Mac Os X	From 10.13.0 to 10.13.6
Apple Mac Os X	From 10.15.0 to 10.15.6
Apple Mac Os X	Version 10.13.6
Apple Mac Os X	Version 10.13.6 security_update_2018-002
Apple Mac Os X	Version 10.13.6 security_update_2018-003
Apple Mac Os X	Version 10.13.6 security_update_2019-001
Apple Mac Os X	Version 10.13.6 security_update_2019-002
Apple Mac Os X	Version 10.13.6 security_update_2019-003
Apple Mac Os X	Version 10.13.6 security_update_2019-004
Apple Mac Os X	Version 10.13.6 security_update_2019-005
Apple Mac Os X	Version 10.13.6 security_update_2019-006
Apple Mac Os X	Version 10.13.6 security_update_2019-007
Apple Mac Os X	Version 10.13.6 security_update_2020-001
Apple Mac Os X	Version 10.13.6 security_update_2020-002
Apple Mac Os X	Version 10.13.6 security_update_2020-003
Apple Mac Os X	Version 10.14.6 security_update_2019-001
Apple Mac Os X	Version 10.14.6 security_update_2019-002
Apple Mac Os X	Version 10.14.6 security_update_2019-004
Apple Mac Os X	Version 10.14.6 security_update_2019-005
Apple Mac Os X	Version 10.14.6 security_update_2019-006
Apple Mac Os X	Version 10.14.6 security_update_2019-007
Apple Mac Os X	Version 10.14.6 security_update_2020-001
Apple Mac Os X	Version 10.14.6 security_update_2020-002
Apple Mac Os X	Version 10.14.6 security_update_2020-003