Summary
It was discovered that the Cyrus SASL SQL plugin incorrectly handled SQL
input. A remote attacker could use this issue to execute arbitrary SQL
commands.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | cyrus-sasl2 | 2.1.27~101-g0780600+dfsg-3ubuntu2.4 |
| Ubuntu · 20.04 LTS 20.04:LTS | cyrus-sasl2 | 2.1.27+dfsg-2ubuntu0.1 |
Vulnerabilities 1
-
Unscored —
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDAT…
References
-
report
https://ubuntu.com/security/CVE-2022-24407