5
CVSSv2

CVE-2019-19906

Published: 19/12/2019 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

It exists that Cyrus SASL incorrectly handled certain LDAP packets. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

cyrusimap cyrus-sasl

debian debian linux 8.0

debian debian linux 9.0

debian debian linux 10.0

canonical ubuntu linux 18.04

canonical ubuntu linux 14.04

canonical ubuntu linux 19.10

canonical ubuntu linux 16.04

canonical ubuntu linux 12.04

fedoraproject fedora 31

fedoraproject fedora 32

redhat enterprise linux 7.0

redhat enterprise linux 6.0

redhat jboss enterprise web server 2.0.0

redhat enterprise linux 5.0

redhat enterprise linux 8.0

apple mac os x 10.14.6

redhat enterprise linux server tus 8.4

redhat enterprise linux eus 8.4

redhat enterprise linux server aus 8.4

redhat enterprise linux server update services for sap solutions 8.4

redhat enterprise linux for power little endian 8.0

redhat enterprise linux for ibm z systems eus 8.4

redhat enterprise linux for ibm z systems 8.0

redhat enterprise linux for power little endian eus 8.4

redhat enterprise linux server for power little endian update services for sap solutions 8.4

apple mac os x

apple mac os x 10.13.6

apple iphone os 13.6

apple ipados 13.6

apache bookkeeper 4.12.1

Vendor Advisories

Debian Bug report logs - #947043 cyrus-sasl2: CVE-2019-19906: Off-by-one in _sasl_add_string function Package: src:cyrus-sasl2; Maintainer for src:cyrus-sasl2 is Debian Cyrus Team <team+cyrus@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 19 Dec 2019 20:21:01 UTC Severity: grave ...
Cyrus SASL could be made to crash or execute arbitrary code if it received a specially crafted LDAP packet ...
Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library For the oldstable distribution (stretch), ...
Synopsis Moderate: cyrus-sasl security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for cyrus-sasl is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scor ...
Synopsis Moderate: Release of OpenShift Serverless 1110 Type/Severity Security Advisory: Moderate Topic Release of OpenShift Serverless 1110 Description Red Hat OpenShift Serverless 1110 is a generally available release of theOpenShift Serverless Operator This version of the OpenShif ...
Synopsis Moderate: OpenShift Container Platform 46 compliance-operator security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for compliance-content-container, ose-compliance-openscap-container, ose-compliance-operator-container, and ose-compliance-operator-metadata-container ...
Synopsis Moderate: Release of OpenShift Serverless 1120 Type/Severity Security Advisory: Moderate Topic Release of OpenShift Serverless 1120Red Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (CVSS) base score,which gives a detaile ...
Synopsis Moderate: Red Hat Quay v333 bug fix and security update Type/Severity Security Advisory: Moderate Topic Red Hat Quay v333 is now available with bug fixes and security updatesRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring S ...
Synopsis Moderate: OpenShift Container Platform 46 compliance-operator security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for compliance-content-container, ose-compliance-openscap-container, ose-compliance-operator-container, and ose-compliance-operator-metadata-container ...
Synopsis Moderate: OpenShift Container Platform 4103 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4103 is now available withupdates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impact of ...
Synopsis Moderate: Red Hat OpenShift Container Storage 460 security, bug fix, enhancement update Type/Severity Security Advisory: Moderate Topic Updated images are now available for Red Hat OpenShift Container Storage 460 on Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as ha ...

Mailing Lists

<!--X-Body-Begin--> <!--X-User-Header--> Full Disclosure mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> APPLE-SA-2020-07-15-2 macOS Catalina 10156, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra <! ...
<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> Fwd: Cyrus-SASL 2128 released [fixes CVE-2022-24407 &amp; CVE-2019-19906] <!--X-Subject-Header-End--> <!--X-Head-of-Message- ...