Lucene search
AmazonALAS2-2022-1758HistoryMar 07, 2022 - 11:29 p.m.
Important: cyrus-sasl
2022-03-0723:29:00
alas.aws.amazon.com
23
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
9.5 High
AI Score
Confidence
High
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
68.8%
Issue Overview:
A flaw was found in the SQL plugin shipped with Cyrus SASL. Failure to properly escape the SQL input allows a remote attacker to execute arbitrary SQL commands. This issue can lead to the escalation of privileges. (CVE-2022-24407)
Affected Packages:
cyrus-sasl
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update cyrus-sasl to update your system.
New Packages:
aarch64:
cyrus-sasl-2.1.26-24.amzn2.aarch64
cyrus-sasl-lib-2.1.26-24.amzn2.aarch64
cyrus-sasl-devel-2.1.26-24.amzn2.aarch64
cyrus-sasl-gssapi-2.1.26-24.amzn2.aarch64
cyrus-sasl-plain-2.1.26-24.amzn2.aarch64
cyrus-sasl-md5-2.1.26-24.amzn2.aarch64
cyrus-sasl-ntlm-2.1.26-24.amzn2.aarch64
cyrus-sasl-sql-2.1.26-24.amzn2.aarch64
cyrus-sasl-ldap-2.1.26-24.amzn2.aarch64
cyrus-sasl-scram-2.1.26-24.amzn2.aarch64
cyrus-sasl-gs2-2.1.26-24.amzn2.aarch64
cyrus-sasl-debuginfo-2.1.26-24.amzn2.aarch64
i686:
cyrus-sasl-2.1.26-24.amzn2.i686
cyrus-sasl-lib-2.1.26-24.amzn2.i686
cyrus-sasl-devel-2.1.26-24.amzn2.i686
cyrus-sasl-gssapi-2.1.26-24.amzn2.i686
cyrus-sasl-plain-2.1.26-24.amzn2.i686
cyrus-sasl-md5-2.1.26-24.amzn2.i686
cyrus-sasl-ntlm-2.1.26-24.amzn2.i686
cyrus-sasl-sql-2.1.26-24.amzn2.i686
cyrus-sasl-ldap-2.1.26-24.amzn2.i686
cyrus-sasl-scram-2.1.26-24.amzn2.i686
cyrus-sasl-gs2-2.1.26-24.amzn2.i686
cyrus-sasl-debuginfo-2.1.26-24.amzn2.i686
src:
cyrus-sasl-2.1.26-24.amzn2.src
x86_64:
cyrus-sasl-2.1.26-24.amzn2.x86_64
cyrus-sasl-lib-2.1.26-24.amzn2.x86_64
cyrus-sasl-devel-2.1.26-24.amzn2.x86_64
cyrus-sasl-gssapi-2.1.26-24.amzn2.x86_64
cyrus-sasl-plain-2.1.26-24.amzn2.x86_64
cyrus-sasl-md5-2.1.26-24.amzn2.x86_64
cyrus-sasl-ntlm-2.1.26-24.amzn2.x86_64
cyrus-sasl-sql-2.1.26-24.amzn2.x86_64
cyrus-sasl-ldap-2.1.26-24.amzn2.x86_64
cyrus-sasl-scram-2.1.26-24.amzn2.x86_64
cyrus-sasl-gs2-2.1.26-24.amzn2.x86_64
cyrus-sasl-debuginfo-2.1.26-24.amzn2.x86_64
Additional References
Red Hat: CVE-2022-24407
Mitre: CVE-2022-24407
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 2 | aarch64 | cyrus-sasl | < 2.1.26-24.amzn2 | cyrus-sasl-2.1.26-24.amzn2.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | cyrus-sasl-lib | < 2.1.26-24.amzn2 | cyrus-sasl-lib-2.1.26-24.amzn2.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | cyrus-sasl-devel | < 2.1.26-24.amzn2 | cyrus-sasl-devel-2.1.26-24.amzn2.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | cyrus-sasl-gssapi | < 2.1.26-24.amzn2 | cyrus-sasl-gssapi-2.1.26-24.amzn2.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | cyrus-sasl-plain | < 2.1.26-24.amzn2 | cyrus-sasl-plain-2.1.26-24.amzn2.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | cyrus-sasl-md5 | < 2.1.26-24.amzn2 | cyrus-sasl-md5-2.1.26-24.amzn2.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | cyrus-sasl-ntlm | < 2.1.26-24.amzn2 | cyrus-sasl-ntlm-2.1.26-24.amzn2.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | cyrus-sasl-sql | < 2.1.26-24.amzn2 | cyrus-sasl-sql-2.1.26-24.amzn2.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | cyrus-sasl-ldap | < 2.1.26-24.amzn2 | cyrus-sasl-ldap-2.1.26-24.amzn2.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | cyrus-sasl-scram | < 2.1.26-24.amzn2 | cyrus-sasl-scram-2.1.26-24.amzn2.aarch64.rpm |
Related
prion
prion
Default credentials
2022-02-24 15:15:00
nessus
nessus
OracleVM 3.4 : cyrus-sasl (OVMSA-2022-0010)
2022-04-05 00:00:00
EulerOS Virtualization 3.0.2.6 : cyrus-sasl (EulerOS-SA-2023-1054)
2023-01-06 00:00:00
RHEL 8 : cyrus-sasl (RHSA-2022:0658)
2022-02-23 00:00:00
debian
debian
[SECURITY] [DSA 5087-1] cyrus-sasl2 security update
2022-02-25 22:25:06
[SECURITY] [DLA 2931-1] cyrus-sasl2 security update
2022-03-06 17:15:21
cloudlinux
cloudlinux
Fix of CVE: CVE-2022-24407
2022-02-28 15:06:37
freebsd
freebsd
cyrus-sasl -- Escape password for SQL insert/update commands
2022-02-04 00:00:00
MySQL -- Multiple vulnerabilities
2023-01-20 00:00:00
almalinux
almalinux
Important: cyrus-sasl security update
2022-02-23 13:33:12
redhat
redhat
(RHSA-2022:0731) Important: cyrus-sasl security update
2022-03-02 13:53:08
(RHSA-2022:0730) Important: cyrus-sasl security update
2022-03-02 13:49:29
(RHSA-2022:0668) Important: cyrus-sasl security update
2022-02-24 09:24:22
cve
cve
CVE-2022-24407
2022-02-24 15:15:00
ibm
ibm
oraclelinux
oraclelinux
cyrus-sasl security update
2022-02-24 00:00:00
cyrus-sasl security update
2022-03-21 00:00:00
cyrus-sasl security update
2022-02-24 00:00:00
fedora
fedora
[SECURITY] Fedora 34 Update: cyrus-sasl-2.1.27-9.fc34
2022-03-09 19:16:13
[SECURITY] Fedora 36 Update: cyrus-sasl-2.1.27-18.fc36
2022-03-26 15:32:19
[SECURITY] Fedora 35 Update: cyrus-sasl-2.1.27-14.fc35
2022-03-08 21:23:02
rocky
rocky
cyrus-sasl security update
2022-02-23 13:33:12
gitlab
gitlab
mageia
mageia
Updated cyrus-sasl packages fix security vulnerability
2022-03-23 11:36:28
Updated mysql-connector-c++ packages fix security vulnerability
2023-03-19 01:16:28
osv
osv
cyrus-sasl2 - security update
2022-03-06 00:00:00
Important: cyrus-sasl security update
2022-02-23 13:33:12
cyrus-sasl2 - security update
2022-02-25 00:00:00
cbl_mariner
cbl_mariner
CVE-2022-24407 affecting package cyrus-sasl 2.1.27-4
2022-03-19 16:40:52
CVE-2022-24407 affecting package cyrus-sasl 2.1.27-10
2022-04-09 06:51:52
suse
suse
Security update for cyrus-sasl (important)
2022-03-08 00:00:00
centos
centos
cyrus security update
2022-02-25 15:31:36
redos
redos
ROS-20220309-01
2022-03-09 00:00:00
alpinelinux
alpinelinux
CVE-2022-24407
2022-02-24 15:15:00
f5
f5
K82896488 : Cyrus SASL vulnerability CVE-2022-24407
2022-05-18 00:00:00
amazon
amazon
Important: cyrus-sasl
2022-03-10 00:54:00
ubuntucve
ubuntucve
CVE-2022-24407
2022-02-22 00:00:00
debiancve
debiancve
CVE-2022-24407
2022-02-24 15:15:00
redhatcve
redhatcve
CVE-2022-24407
2022-02-23 09:22:54
veracode
veracode
Remote Code Execution (RCE)
2022-03-12 00:42:04
cloudfoundry
cloudfoundry
USN-5301-1: Cyrus SASL vulnerability | Cloud Foundry
2022-04-21 00:00:00
ubuntu
ubuntu
Cyrus SASL vulnerability
2022-02-22 00:00:00
Cyrus SASL vulnerability
2022-02-22 00:00:00
photon
photon
Important Photon OS Security Update - PHSA-2022-0368
2022-03-04 00:00:00
Important Photon OS Security Update - PHSA-2022-3.0-0368
2022-03-08 00:00:00
Important Photon OS Security Update - PHSA-2022-0477
2022-03-04 00:00:00
slackware
slackware
[slackware-security] cyrus-sasl
2022-02-25 00:10:10
oracle
oracle
Oracle Critical Patch Update Advisory - October 2023
2023-10-17 00:00:00
Oracle Critical Patch Update Advisory - January 2023
2023-01-17 00:00:00
Oracle Critical Patch Update Advisory - July 2022
2022-07-19 00:00:00
ics
ics
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
2023-12-14 12:00:00
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
9.5 High
AI Score
Confidence
High
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
68.8%
Related for ALAS2-2022-1758