Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-24407: A flaw was found in the SQL plugin shipped with Cyrus SASL. Failure to properly escape the SQL input allows a remote attacker to execute arbitrary SQL commands. This issue can lead to the escalation of privileges.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | cyrus-sasl | 0:2.1.26-24.amzn2 |
| Amazon Linux · 2 | cyrus-sasl-debuginfo | 0:2.1.26-24.amzn2 |
| Amazon Linux · 2 | cyrus-sasl-devel | 0:2.1.26-24.amzn2 |
| Amazon Linux · 2 | cyrus-sasl-gs2 | 0:2.1.26-24.amzn2 |
| Amazon Linux · 2 | cyrus-sasl-gssapi | 0:2.1.26-24.amzn2 |
| Amazon Linux · 2 | cyrus-sasl-ldap | 0:2.1.26-24.amzn2 |
| Amazon Linux · 2 | cyrus-sasl-lib | 0:2.1.26-24.amzn2 |
| Amazon Linux · 2 | cyrus-sasl-md5 | 0:2.1.26-24.amzn2 |
| Amazon Linux · 2 | cyrus-sasl-ntlm | 0:2.1.26-24.amzn2 |
| Amazon Linux · 2 | cyrus-sasl-plain | 0:2.1.26-24.amzn2 |
| Amazon Linux · 2 | cyrus-sasl-scram | 0:2.1.26-24.amzn2 |
| Amazon Linux · 2 | cyrus-sasl-sql | 0:2.1.26-24.amzn2 |
Vulnerabilities 1
-
Unscored —
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDAT…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-24407.html