7.5

CVE-2019-19906: apache bookkeeper Off-by-one Error

CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2019-19906MGASA-2020-0011SUSE-SU-2020:14579-1
Published 19-12-2019Last modified 14-10-2026
Open JSON

Vulnerability summary

CVE-2019-19906 is a high (CVSS 7.5) Off-by-one Error vulnerability in apache bookkeeper. EPSS estimates a 8.04% chance of exploitation in the next 30 days, higher than 94.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
42/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
8.04%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2024:10709-1

Timeline

  1. 19-12-2019
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

8.04%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 8.04% on 18-09-2026

18-09-202618-10-2026
EPSS score
8.04%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (openldap.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse62 products
  • cyrus-sasl-openssl1&distro=SUSE Linux Enterprise Server 11-SECURITY< 2.1.22-182.26.4.1
  • cyrus-sasl-saslauthd&distro=SUSE Enterprise Storage 6< 2.1.26-150000.5.13.1
  • cyrus-sasl-saslauthd&distro=SUSE Enterprise Storage 7< 2.1.26-150000.5.13.1
  • cyrus-sasl-saslauthd&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 2.1.26-150000.5.13.1
  • cyrus-sasl-saslauthd&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2.1.26-150000.5.13.1
Redhat34 products
Apple3 products
  • ipadosEOL13.6
  • iphone_osEOL13.6
  • mac_os_x10.14.6 | < 10.13.6 | ≥ 10.13.0, < 10.13.6 | ≥ 10.15.0, < 10.15.6 | 10.13.6 | 10.13.6:security_update_2018-002 | 10.13.6:security_update_2018-003 | 10.13.6:security_update_2019-001 | 10.13.6:security_update_2019-002 | 10.13.6:security_update_2019-003 | 10.13.6:security_update_2019-004 | 10.13.6:security_update_2019-005 | 10.13.6:security_update_2019-006 | 10.13.6:security_update_2019-007 | 10.13.6:security_update_2020-001 | 10.13.6:security_update_2020-002 | 10.13.6:security_update_2020-003 | 10.14.6:security_update_2019-001 | 10.14.6:security_update_2019-002 | 10.14.6:security_update_2019-004 | 10.14.6:security_update_2019-005 | 10.14.6:security_update_2019-006 | 10.14.6:security_update_2019-007 | 10.14.6:security_update_2020-001 | 10.14.6:security_update_2020-002 | 10.14.6:security_update_2020-003
Debian2 products
  • cyrus-sasl2< 2.1.27~101-g0780600+dfsg-3+deb9u1 | < 2.1.27+dfsg-1+deb10u1 | < 2.1.26.dfsg1-13+deb8u2 | < 2.1.27+dfsg-2
  • debian_linuxEOL8.0 | 9.0 | 10.0
Alpine1 product
  • cyrus-sasl< 2.1.27-r4 | < 2.1.27-r5 | < 2.1.26-r15 | < 2.1.27-r2
Apache1 product
Canonical1 product
Cyrusimap1 product
Fedoraproject1 product
Mageia1 product
  • cyrus-sasl< 2.1.27-1.1.mga7
Ubuntu1 product
  • cyrus-sasl2< 2.1.25.dfsg1-17ubuntu0.1~esm1 | < 2.1.26.dfsg1-14ubuntu0.2 | < 2.1.27~101-g0780600+dfsg-3ubuntu2.1

11 vendors · 108 products

References

37 links
Show all 37 references