Logo
›
›vulnerability›CVE-2022-24407
Name
CVE-2022-24407
Source
NVD ( link)Debian ( link)
Description
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
CWEs
CWE-89
Published Date
Updated Date
Workaround
-
Advisories
http://www.openwall.com/lists/oss-security/2022/02/23/4Mailing List
https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rstRelease Notes
https://lists.debian.org/debian-lts-announce/2022/03/msg00002.htmlMailing List
https://security.netapp.com/advisory/ntap-20221007-0003/Third Party Advisory
https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28Release Notes
https://www.debian.org/security/2022/dsa-5087Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch
http://www.openwall.com/lists/oss-security/2022/02/23/4Mailing List
https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rstRelease Notes
https://lists.debian.org/debian-lts-announce/2022/03/msg00002.htmlMailing List
https://security.netapp.com/advisory/ntap-20221007-0003/Third Party Advisory
https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28Release Notes
https://www.debian.org/security/2022/dsa-5087Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch

Analysis#

Affected Component
Analysis
cyrus-sasl
Patched

Vulnerability Ratings#

8.8
CVSSv31
6.5
CVSSv2

Others affected components#

Name
Project
Project Version
Version
Status
cyrus-sasl
openwrt
master
2.1.28-r5
Not Affected
cyrus-sasl
openwrt
openwrt-25.12
2.1.28-r4
Not Affected
cyrus-sasl
yocto
master
2.1.28
Patched
cyrus-sasl
yocto
scarthgap
2.1.28
Patched

Resolved with patches#

cyrus-sasl (yocto:kirkstone)

#
Title
Author
Resolve
1
CVE-2022-24407
Hitendra Prajapati <hprajapati@mvista.com>
CVE-2022-24407

cyrus-sasl (yocto:master)

#
Title
Author
Resolve
1
CVE-2022-24407
Hitendra Prajapati <hprajapati@mvista.com>
CVE-2022-24407

cyrus-sasl (yocto:scarthgap)

#
Title
Author
Resolve
1
CVE-2022-24407
Hitendra Prajapati <hprajapati@mvista.com>
CVE-2022-24407