Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service (thread crash and consumption) via (1) an invalid salt or, when FIPS-140 is enabled, a (2) DES or (3) MD5 encrypted password, which triggers a NULL pointer dereference.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cyrus-sasl | Aug 30, 2017 | Oct 27, 2013 |
| Debian | — | Upgrade cyrus-sasl2 | Jul 30, 2024 | Oct 27, 2013 |
| Gentoo Linux | — | Upgrade dev-libs/cyrus-sasl. | Oct 30, 2017 | Oct 26, 2013 |
| Ubuntu | — | Upgrade libsasl2-2 | Nov 8, 2024 | Oct 27, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub