Red Hat Security AdvisoryRHSA-2022:0780
cyrus-sasl security update
Released 2022-03-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 6 ELS) cyrus-sasl-2.1.23-16.el6_10, cyrus-sasl-devel-2.1.23-16.el6_10, cyrus-sasl-gssapi-2.1.23-16.el6_10 +3
- Red Hat Enterprise Linux Server Optional (v. 6 ELS) cyrus-sasl-ldap-2.1.23-16.el6_10, cyrus-sasl-ntlm-2.1.23-16.el6_10, cyrus-sasl-sql-2.1.23-16.el6_10
Fixes 1 record
Priority MEDIUM 45
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.04123 · Published 2022-02-23 · Partial fix CWE-89
