CVE-2019-13565: apple mac_os_x
Vulnerability summary
CVE-2019-13565 is a high (CVSS 7.5) vulnerability in apple mac_os_x. EPSS estimates a 5.01% chance of exploitation in the next 30 days, higher than 92.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 10 · Related 8Timeline
- 26-07-2019PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
5.01%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 5.01% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Oracle3 products
- blockchain_platform< 21.1.2
- solarisEOL11
- zfs_storage_appliance_kit8.8
Debian2 products
- openldap< 2.4.48+dfsg-1
- debian_linuxEOL8.0
Alpine1 product
- openldap≥ 2.0, < 2.4.48-r0
Apple1 product
- mac_os_x≥ 10.13, < 10.13.6 | ≥ 10.14, < 10.14.6 | ≥ 10.15, < 10.15.2 | 10.13.6 | 10.13.6:security_update_2018-002 | 10.13.6:security_update_2018-003 | 10.13.6:security_update_2019-001 | 10.13.6:security_update_2019-002 | 10.13.6:security_update_2019-003 | 10.13.6:security_update_2019-004 | 10.13.6:security_update_2019-005 | 10.13.6:security_update_2019-006 | 10.14.6 | 10.14.6:security_update_2019-001
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 19.04
F51 product
- traffix_signaling_delivery_controller5.0.0 | 5.1.0
Openldap1 product
- openldap≥ 2.0, ≤ 2.4.47
Opensuse1 product
- leapEOL15.0 | 15.1
Ubuntu1 product
- openldap< 2.4.31-1+nmu2ubuntu8.5+esm1 | < 2.4.42+dfsg-2ubuntu3.6 | < 2.4.45+dfsg-1ubuntu1.3
9 vendors · 12 products
References
23 links
lists.debian.org/debian-lts-announce/2019/08/msg00024.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 23 references
- www.openldap.org/lists/openldap-announce/201907/msg00001.htmlX Refsource CONFIRMMailing ListVendor AdvisoryREPORT