vulnerability
Oracle Linux: CVE-2022-24407: ELSA-2022-0658: cyrus-sasl security update (IMPORTANT) (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:L/Au:S/C:P/I:P/A:P) | Feb 22, 2022 | Feb 24, 2022 | Dec 3, 2025 |
Severity
7
CVSS
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
Published
Feb 22, 2022
Added
Feb 24, 2022
Modified
Dec 3, 2025
Description
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
A flaw was found in the SQL plugin shipped with Cyrus SASL. The vulnerability occurs due to failure to properly escape SQL input and leads to an improper input validation vulnerability. This flaw allows an attacker to execute arbitrary SQL commands and the ability to change the passwords for other accounts allowing escalation of privileges.
A flaw was found in the SQL plugin shipped with Cyrus SASL. The vulnerability occurs due to failure to properly escape SQL input and leads to an improper input validation vulnerability. This flaw allows an attacker to execute arbitrary SQL commands and the ability to change the passwords for other accounts allowing escalation of privileges.
Solutions
oracle-linux-upgrade-cyrus-sasloracle-linux-upgrade-cyrus-sasl-develoracle-linux-upgrade-cyrus-sasl-gs2oracle-linux-upgrade-cyrus-sasl-gssapioracle-linux-upgrade-cyrus-sasl-ldaporacle-linux-upgrade-cyrus-sasl-liboracle-linux-upgrade-cyrus-sasl-md5oracle-linux-upgrade-cyrus-sasl-ntlmoracle-linux-upgrade-cyrus-sasl-plainoracle-linux-upgrade-cyrus-sasl-scramoracle-linux-upgrade-cyrus-sasl-sql
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.