Description
SQL injection vulnerability in SQLgrey Postfix greylisting service before 1.2.0 allows remote attackers to execute arbitrary SQL commands via the (1) sender or (2) recipient e-mail addresses.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sqlgrey | 1.2.0 | — |
| Debian 13 | sqlgrey | 1.2.0 | — |
| Debian 12 | sqlgrey | 1.2.0 | — |
References
- 11633 vdb-entry
- 2004-0058 vendor-advisory
- sqlgrey-postfix-sql-injection(17998) vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=281256
- 13135 third-party-advisory