CVE-2019-13057: apple mac_os_x
Vulnerability summary
CVE-2019-13057 is a medium (CVSS 4.9) vulnerability in apple mac_os_x. EPSS estimates a 3.42% chance of exploitation in the next 30 days, higher than 88.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 10 · Related 8Timeline
- 26-07-2019PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
3.42%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.42% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Oracle3 products
- blockchain_platform< 21.1.2
- solarisEOL11
- zfs_storage_appliance_kit8.8
Debian2 products
- openldap< 2.4.48+dfsg-1
- debian_linuxEOL8.0
Alpine1 product
- openldap< 2.4.48-r0
Apple1 product
- mac_os_x≥ 10.13, < 10.13.6 | ≥ 10.14, < 10.14.6 | ≥ 10.15, < 10.15.2 | 10.13.6 | 10.13.6:security_update_2018-002 | 10.13.6:security_update_2018-003 | 10.13.6:security_update_2019-001 | 10.13.6:security_update_2019-002 | 10.13.6:security_update_2019-003 | 10.13.6:security_update_2019-004 | 10.13.6:security_update_2019-005 | 10.13.6:security_update_2019-006 | 10.14.6 | 10.14.6:security_update_2019-001
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 19.04
Mcafee1 product
- policy_auditor< 6.5.1 | 6.5.1
Openldap1 product
- openldap< 2.4.48
Opensuse1 product
- leapEOL15.0 | 15.1
Ubuntu1 product
- openldap< 2.4.31-1+nmu2ubuntu8.5+esm1 | < 2.4.42+dfsg-2ubuntu3.6 | < 2.4.45+dfsg-1ubuntu1.3
9 vendors · 12 products
References
21 links
lists.debian.org/debian-lts-announce/2019/08/msg00024.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 21 references
- www.openldap.org/lists/openldap-announce/201907/msg00001.htmlX Refsource CONFIRMMailing ListProductVendor AdvisoryREPORT