Red Hat Security Advisory

RHSA-2022:0666

cyrus-sasl security update

Released 2022-02-24 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) cyrus-sasl-2.1.26-24.el7_9, cyrus-sasl-gssapi-2.1.26-24.el7_9, cyrus-sasl-lib-2.1.26-24.el7_9 +3
Red Hat Enterprise Linux Client Optional (v. 7) cyrus-sasl-2.1.26-24.el7_9, cyrus-sasl-devel-2.1.26-24.el7_9, cyrus-sasl-gs2-2.1.26-24.el7_9 +3
Red Hat Enterprise Linux ComputeNode Optional (v. 7) cyrus-sasl-2.1.26-24.el7_9, cyrus-sasl-devel-2.1.26-24.el7_9, cyrus-sasl-gs2-2.1.26-24.el7_9 +4
Red Hat Enterprise Linux Server (v. 7) cyrus-sasl-2.1.26-24.el7_9, cyrus-sasl-2.1.26-24.el7_9.ppc, cyrus-sasl-devel-2.1.26-24.el7_9 +11
Red Hat Enterprise Linux Server Optional (v. 7) cyrus-sasl-gs2-2.1.26-24.el7_9, cyrus-sasl-gs2-2.1.26-24.el7_9.ppc, cyrus-sasl-ldap-2.1.26-24.el7_9 +5
Red Hat Enterprise Linux Workstation (v. 7) cyrus-sasl-2.1.26-24.el7_9, cyrus-sasl-devel-2.1.26-24.el7_9, cyrus-sasl-gssapi-2.1.26-24.el7_9 +4
Red Hat Enterprise Linux Workstation Optional (v. 7) cyrus-sasl-gs2-2.1.26-24.el7_9, cyrus-sasl-ldap-2.1.26-24.el7_9, cyrus-sasl-ntlm-2.1.26-24.el7_9 +1

TI-2022-08283 CVE-2022-24407 · GHSA-fvc5-cffp-h22w

MEDIUM 45

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04123 Published 2022-02-23 Partial fix CWE-89