8.8
CVSSv3

CVE-2022-24407

Published: 24/02/2022 Updated: 07/11/2023
CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8
CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8
VMScore: 580
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Vulnerability Summary

In Cyrus SASL 2.1.17 up to and including 2.1.27 prior to 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

cyrusimap cyrus-sasl

debian debian linux 9.0

debian debian linux 10.0

debian debian linux 11.0

fedoraproject fedora 34

fedoraproject fedora 35

fedoraproject fedora 36

netapp ontap select deploy administration utility -

netapp active iq unified manager -

oracle communications cloud native core security edge protection proxy 22.1.1

oracle communications cloud native core console 22.2.0

oracle communications cloud native core network function cloud native environment 22.2.0

Vendor Advisories

It was discovered that the SQL plugin in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer, is prone to a SQL injection attack An authenticated remote attacker can take advantage of this flaw to execute arbitrary SQL commands and for privilege escalation For the oldstable distribution (buster), this problem has been ...
A flaw was found in the SQL plugin shipped with Cyrus SASL Failure to properly escape the SQL input allows a remote attacker to execute arbitrary SQL commands This issue can lead to the escalation of privileges (CVE-2022-24407) ...
A flaw was found in the SQL plugin shipped with Cyrus SASL Failure to properly escape the SQL input allows a remote attacker to execute arbitrary SQL commands This issue can lead to the escalation of privileges (CVE-2022-24407) ...
A flaw was found in the SQL plugin shipped with Cyrus SASL Failure to properly escape the SQL input allows a remote attacker to execute arbitrary SQL commands This issue can lead to the escalation of privileges ...
Synopsis Important: cyrus-sasl security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for cyrus-sasl is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as hav ...
Synopsis Important: Red Hat OpenShift GitOps security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat OpenShift GitOps 14OpenShift GitOps v144Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which ...
Synopsis Important: Red Hat OpenShift GitOps security update Type/Severity Security Advisory: Important Topic An update for openshift-gitops-applicationset-container, openshift-gitops-container, openshift-gitops-kam-delivery-container, and openshift-gitops-operator-container is now available for Red Hat OpenShift GitOps 12 (GitOps v123)Re ...
Synopsis Important: cyrus-sasl security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for cyrus-sasl is now available for Red Hat Enterprise Linux 6 Extended Lifecycle SupportRed Hat Product Security h ...
Synopsis Important: cyrus-sasl security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for cyrus-sasl is now available for Red Hat Enterprise Linux 81 Update Services for SAP SolutionsRed Hat Product S ...
Synopsis Important: cyrus-sasl security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for cyrus-sasl is now available for Red Hat Enterprise Linux 82 Extended Update SupportRed Hat Product Security ha ...
Synopsis Important: cyrus-sasl security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for cyrus-sasl is now available for Red Hat Enterprise Linux 84 Extended Update SupportRed Hat Product Security ha ...
Synopsis Important: cyrus-sasl security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for cyrus-sasl is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as hav ...
Synopsis Moderate: OpenShift Container Platform 4657 security and extras update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4657 is now available withupdates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Conta ...
Synopsis Important: Red Hat Integration Camel-K 164 release and security update Type/Severity Security Advisory: Important Topic A micro version update (from 163 to 164) is now available for Red Hat Integration Camel K that includes bug fixes and enhancements The purpose of this text-only errata is to inform you about the security issu ...
Synopsis Important: RHV-H security update (redhat-virtualization-host) 4322 Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for redhat-release-virtualization-host and redhat-virtualization-host is now availabl ...
Synopsis Important: RHACS 368 security update Type/Severity Security Advisory: Important Topic Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes (RHACS) The updated image includes bug and security fixesRed Hat Product Security has rated this update as having a security impact of Important A Common Vulne ...
Synopsis Moderate: OpenShift Virtualization 4101 Images security and bug fix update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Virtualization release 4101 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a securit ...
Synopsis Moderate: Windows Container Support for Red Hat OpenShift 500 [security update] Type/Severity Security Advisory: Moderate Topic The components for Windows Container Support for Red Hat OpenShift 500 are now available This product release includes bug fixes and a moderate security update for the following packages: windows-machin ...
Synopsis Important: Red Hat OpenShift GitOps security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat OpenShift GitOps 13OpenShift GitOps v136 for OCP 47+Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base ...
Synopsis Important: OpenShift Virtualization 4110 Images security and bug fix update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Virtualization release 4110 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a secur ...
Synopsis Moderate: Gatekeeper Operator v02 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Gatekeeper Operator v02Red Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available f ...
Synopsis Important: OpenShift Container Platform 4110 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 4110 is now available withupdates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Co ...
Synopsis Moderate: Migration Toolkit for Containers (MTC) 173 security and bug fix update Type/Severity Security Advisory: Moderate Topic The Migration Toolkit for Containers (MTC) 173 is now availableRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base ...
Synopsis Moderate: OpenShift Container Platform 4103 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4103 is now available withupdates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impact of ...
Synopsis Moderate: OpenShift Container Platform 4110 extras and security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4110 is now available withupdates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Conta ...
Synopsis Moderate: OpenShift Virtualization 4100 Images security and bug fix update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Virtualization release 4100 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a securit ...
Synopsis Important: Release of containers for OSP 162 director operator tech preview Type/Severity Security Advisory: Important Topic Red Hat OpenStack Platform 162 (Train) director Operator containers areavailable for technology preview Description Release osp-director-operator imagesSecurity Fix(es): golang: net/http: limit growth of h ...
Synopsis Important: OpenShift Container Platform 41145 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41145 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift ...
Synopsis Important: Service Telemetry Framework 14 security update Type/Severity Security Advisory: Important Topic An update is now available for Service Telemetry Framework 14 for RHEL 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which g ...
Synopsis Moderate: Red Hat Advanced Cluster Management 2211 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 2211 General Availability release images, which provide one or more container updates and bug fixesRed Hat Product Security has rated this update as ...
Synopsis Important: Migration Toolkit for Containers (MTC) 174 security and bug fix update Type/Severity Security Advisory: Important Topic The Migration Toolkit for Containers (MTC) 174 is now availableRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) ba ...
Synopsis Moderate: Release of OpenShift Serverless 1210 Type/Severity Security Advisory: Moderate Topic Release of OpenShift Serverless 1210Red Hat Product Security has rated this update as having a security impact ofModerate A Common Vulnerability Scoring System (CVSS) base score, which gives adetailed severity rating, is available for ...
Synopsis Important: Red Hat Virtualization Host security and bug fix update [ovirt-4410] Async #1 Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for redhat-release-virtualization-host and redhat-virtualizatio ...
Synopsis Moderate: Migration Toolkit for Containers (MTC) 154 security update Type/Severity Security Advisory: Moderate Topic The Migration Toolkit for Containers (MTC) 154 is now availableRed Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (CVSS) base score, whichg ...
Synopsis Important: Red Hat Advanced Cluster Management 242 security updates and bug fixes Type/Severity Security Advisory: Important Topic Red Hat Advanced Cluster Management for Kubernetes 242 General Availabilityrelease images This update provides security fixes, fixes bugs, and updates the container imagesRed Hat Product Security ha ...
ALAS-2022-234 Amazon Linux 2022 Security Advisory: ALAS-2022-234 Advisory Release Date: 2022-12-06 16:43 Pacific ...
A flaw was found in the SQL plugin shipped with Cyrus SASL Failure to properly escape the SQL input allows a remote attacker to execute arbitrary SQL commands This issue can lead to the escalation of privileges (CVE-2022-24407) ...

Mailing Lists

<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> Fwd: Cyrus-SASL 2128 released [fixes CVE-2022-24407 &amp; CVE-2019-19906] <!--X-Subject-Header-End--> <!--X-Head-of-Message- ...