vulnerability
Oracle Linux: CVE-2022-24407: ELSA-2022-0666: cyrus-sasl security update (IMPORTANT) (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:L/Au:S/C:C/I:C/A:C) | 2022-02-22 | 2022-02-24 | 2025-01-07 |
Severity
9
CVSS
(AV:N/AC:L/Au:S/C:C/I:C/A:C)
Published
2022-02-22
Added
2022-02-24
Modified
2025-01-07
Description
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
A flaw was found in the SQL plugin shipped with Cyrus SASL. The vulnerability occurs due to failure to properly escape SQL input and leads to an improper input validation vulnerability. This flaw allows an attacker to execute arbitrary SQL commands and the ability to change the passwords for other accounts allowing escalation of privileges.
A flaw was found in the SQL plugin shipped with Cyrus SASL. The vulnerability occurs due to failure to properly escape SQL input and leads to an improper input validation vulnerability. This flaw allows an attacker to execute arbitrary SQL commands and the ability to change the passwords for other accounts allowing escalation of privileges.
Solution(s)
oracle-linux-upgrade-cyrus-sasloracle-linux-upgrade-cyrus-sasl-develoracle-linux-upgrade-cyrus-sasl-gs2oracle-linux-upgrade-cyrus-sasl-gssapioracle-linux-upgrade-cyrus-sasl-ldaporacle-linux-upgrade-cyrus-sasl-liboracle-linux-upgrade-cyrus-sasl-md5oracle-linux-upgrade-cyrus-sasl-ntlmoracle-linux-upgrade-cyrus-sasl-plainoracle-linux-upgrade-cyrus-sasl-scramoracle-linux-upgrade-cyrus-sasl-sql
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.