Summary
The cyrus-sasl packages contain the Cyrus implementation of Simple Authentication and Security Layer (SASL). SASL is a method for adding authentication support to connection-based protocols.
Security Fix(es):
* cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands (CVE-2022-24407)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | cyrus-sasl | 2.1.27-6.el8_5 |
| AlmaLinux · 8 | cyrus-sasl-devel | 2.1.27-6.el8_5 |
| AlmaLinux · 8 | cyrus-sasl-gs2 | 2.1.27-6.el8_5 |
| AlmaLinux · 8 | cyrus-sasl-gssapi | 2.1.27-6.el8_5 |
| AlmaLinux · 8 | cyrus-sasl-ldap | 2.1.27-6.el8_5 |
| AlmaLinux · 8 | cyrus-sasl-lib | 2.1.27-6.el8_5 |
| AlmaLinux · 8 | cyrus-sasl-md5 | 2.1.27-6.el8_5 |
| AlmaLinux · 8 | cyrus-sasl-ntlm | 2.1.27-6.el8_5 |
| AlmaLinux · 8 | cyrus-sasl-plain | 2.1.27-6.el8_5 |
| AlmaLinux · 8 | cyrus-sasl-scram | 2.1.27-6.el8_5 |
| AlmaLinux · 8 | cyrus-sasl-sql | 2.1.27-6.el8_5 |
Vulnerabilities 1
-
Unscored —
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDAT…
References
-
report
https://vulners.com/cve/CVE-2022-24407