CVE-2022-24407

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement...

USN-5301-2: Cyrus SASL vulnerability

USN-5301-1 fixed a vulnerability in Cyrus. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that the Cyrus SASL SQL plugin incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrar...

USN-5301-1: Cyrus SASL vulnerability

It was discovered that the Cyrus SASL SQL plugin incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrary SQL commands...

CVE-2022-24407

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement...

UBUNTU-CVE-2022-24407

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement...

PT-2022-1907 · Unknown +10 · Cyrus-Sasl +10

Name of the Vulnerable Software and Affected Versions: Cyrus SASL versions 2.1.17 through 2.1.27 Description: The issue is related to the implementation of the authentication mechanism in Cyrus SASL, where the SQL query structure is not properly protected. This could allow a remote attacker to...

FreeBSD : cyrus-sasl -- Escape password for SQL insert/update commands (022dde12-8f4a-11ec-83ac-080027415d17)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 022dde12-8f4a-11ec-83ac-080027415d17 advisory. - In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a S...

Cyrus Sasl SQL注入漏洞

Cyrus Sasl is a simple authentication from The Cyrus Team team. Enables application developers to easily integrate authentication mechanisms into applications in a generic way. Cyrus SASL A SQL injection vulnerability exists that stems from the Cyrus SASL SQL plugin incorrectly handling SQL input...

Ubuntu 18.04 LTS / 20.04 LTS : Cyrus SASL vulnerability (USN-5301-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5301-1 advisory. It was discovered that the Cyrus SASL SQL plugin incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrary SQL...

AlmaLinux 8 : cyrus-sasl (ALSA-2020:4497)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:4497 advisory. - cyrus-sasl aka Cyrus SASL 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of- service in OpenLDAP via a malformed LDAP packet. The...

cyrus-sasl -- Escape password for SQL insert/update commands

Cyrus SASL 2.1.x Release Notes New in 2.1.28 reports: Escape password for SQL insert/update commands...

Mageia: Security Advisory (MGASA-2020-0011)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2019-0206)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OSV-2021-1737 Heap-buffer-overflow in Curl_sasl_decode_mech

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42727 Crash type: Heap-buffer-overflow READ 10 Crash state: Curlsasldecodemech Curlsaslparseurlauthoption pop3parseurloptions...

OpenLDAP < 2.4.48 Multiple Vulnerabilities

OpenLDAP is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

python-ldap bug fix and enhancement update

The python-ldap packages provide an object-oriented API for working with LDAP within Python programs. It allows access to LDAP directory servers by using the OpenLDAP 2.x libraries, and contains modules for other LDAP-related tasks including processing LDIF, LDAPURLs, LDAPv3 schema, etc.. Bug Fix...

Confidentiality Protection Bypass

Apache Directory Studio is vulnerable to confidentiality protection bypass. The vulnerability exists because it does not apply SASL confidentiality layer when SASL authentication mechanism is used...

Missing encryption in Apache Directory Studio

While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism DIGEST-MD5, GSSAPI was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue...

GHSA-4X25-F45X-GRV5 Missing encryption in Apache Directory Studio

While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism DIGEST-MD5, GSSAPI was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue...

CVE-2021-33900

While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism DIGEST-MD5, GSSAPI was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue...