CVE-2019-19906: Apache Bookkeeper

High severity, CVSS 7.5. EPSS: 8% chance of exploitation in the next 30 days.

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.

Affected products

• Apache Bookkeeper: version 4.12.1 only
• Apple iPadOS: version 13.6 only
• Apple iPhone OS: version 13.6 only
• Apple Mac OS X: version 10.14.6 only; before 10.13.6 (fixed in 10.13.6); from 10.13.0, before 10.13.6 (fixed in 10.13.6); from 10.15.0, before 10.15.6 (fixed in 10.15.6); version 10.13.6 only
• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 19.10 only
• Cyrusimap Cyrus-Sasl: before 2.1.28 (fixed in 2.1.28)
• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 31 only; version 32 only
• Red Hat Enterprise Linux: version 5.0 only; version 6.0 only; version 7.0 only; version 8.0 only
• Red Hat Enterprise Linux Eus: version 8.4 only
• Red Hat Enterprise Linux For IBM Z Systems: version 8.0 only
• Red Hat Enterprise Linux For IBM Z Systems Eus: version 8.4 only
• Red Hat Enterprise Linux For Power Little Endian: version 8.0 only
• Red Hat Enterprise Linux For Power Little Endian Eus: version 8.4 only
• Red Hat Enterprise Linux Server Aus: version 8.4 only
• Red Hat Enterprise Linux Server For Power Little Endian Update Services For SAP Solutions: version 8.4 only
• Red Hat Enterprise Linux Server Tus: version 8.4 only
• Red Hat Enterprise Linux Server Update Services For SAP Solutions: version 8.4 only
• Red Hat JBoss Enterprise Web Server: version 2.0.0 only

Published 2019-12-19. Last modified 2026-06-17.