Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-24407: A flaw was found in the SQL plugin shipped with Cyrus SASL. Failure to properly escape the SQL input allows a remote attacker to execute arbitrary SQL commands. This issue can lead to the escalation of privileges.
Fixed packages 23
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | cyrus-sasl | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-debuginfo | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-debugsource | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-devel | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-devel-debuginfo | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-gs2 | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-gs2-debuginfo | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-gssapi | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-gssapi-debuginfo | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-ldap | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-ldap-debuginfo | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-lib | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-lib-debuginfo | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-md5 | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-md5-debuginfo | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-ntlm | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-ntlm-debuginfo | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-plain | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-plain-debuginfo | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-scram | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-scram-debuginfo | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-sql | 0:2.1.27-18.amzn2023.0.3 |
| Amazon Linux · 2023 | cyrus-sasl-sql-debuginfo | 0:2.1.27-18.amzn2023.0.3 |
Vulnerabilities 1
-
Unscored —
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDAT…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-24407.html