• [SECURITY] [DSA 5087-1] cyrus-sasl2 security update

    From Salvatore Bonaccorso@21:1/5 to All on Fri Feb 25 23:30:01 2022
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-5087-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso February 25, 2022 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : cyrus-sasl2
    CVE ID : CVE-2022-24407

    It was discovered that the SQL plugin in cyrus-sasl2, a library
    implementing the Simple Authentication and Security Layer, is prone to a
    SQL injection attack. An authenticated remote attacker can take
    advantage of this flaw to execute arbitrary SQL commands and for
    privilege escalation.

    For the oldstable distribution (buster), this problem has been fixed
    in version 2.1.27+dfsg-1+deb10u2.

    For the stable distribution (bullseye), this problem has been fixed in
    version 2.1.27+dfsg-2.1+deb11u1.

    We recommend that you upgrade your cyrus-sasl2 packages.

    For the detailed security status of cyrus-sasl2 please refer to its
    security tracker page at: https://security-tracker.debian.org/tracker/cyrus-sasl2

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmIZVw9fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0SKYxAAho3dEbjC//m2kbMP1qZv/9vurrjc8HEwYGeAZFUv270wg67AHk/5XJow UhkeLbFYRwA3WrwvFVuGPWPev3vKxn5dyy9A5s9N6rcl2Izi12g7NmGC3ihd/Gdo wBtoOTJhV95iSyv8CfY0Fc7Fszgi7yqnAPAO3k/q+Nf0Gw4U2K7te9RmsR/eD0p5 iH0x+WliE4z4ZSOrbysiDxy/3UEJDjTP3smsfB8l5XME0cXtxfzuukdUzBbGsP5Z hxR0TOE6YjA+81W+NYsJniBKfupBXPsVwPcltPZBDFnrnWygcSt5n2y7sOosudLe JY9VHHmqNZNIc1/BywMTNtFcWbXaUAglaXucoYo+OreOvKtp2faSNDwA5JUwrgJ4 gKbhilASS+kXXybc6OUavEbncFWJaSDENaRol5NzlAaGSnuwfxIpjIc54NwdERah 45JGLLIl+R8Psz2/UEPgm629NuJ5y76nkKCE3/H6hTP2NJg08OKaplg5Ak8vyubr I/dbBKq5qV/yW9anp9Y1HCdrvQLhuI/TrEtR1e0oG161IbTikbLHk2+xSdMsIFDL +WwOqzMAM1I2zOB9m9ejs2ToIq6fynPJJrEczDn0IDLRib/wmdM08lJnAc60Sj9m 1JXV34BujSxYVJDdxAfR79M7HeBObJA7MsEPygtaKP4Lh5pr3BQ=
    =mI2X
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)