CVE-2019-19906 — cyrus-sasl2 - security update

Description

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.

How to fix CVE-2019-19906

To remediate CVE-2019-19906, upgrade the affected package to a fixed version below.

—upgrade to 2.1.27-r4 or later
—upgrade to 2.1.27+dfsg-2 or later
—upgrade to 2.1.26.dfsg1-13+deb8u2 or later
—upgrade to 2.1.27~101-g0780600+dfsg-3+deb9u1 or later

Is CVE-2019-19906 being exploited?

Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

from 0, < 2.1.27-r4
from 0, < 2.1.27+dfsg-2
from 0, < 2.1.26.dfsg1-13+deb8u2
from 0, < 2.1.27~101-g0780600+dfsg-3+deb9u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (2)

ADVISORYsecurity.alpinelinux.org/vuln/CVE-2019-19906
ADVISORYsecurity-tracker.debian.org/tracker/CVE-2019-19906