USN-5301-1: Cyrus SASL vulnerability

Releases

• Ubuntu 21.10
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• cyrus-sasl2 - Cyrus Simple Authentication and Security Layer

Details

It was discovered that the Cyrus SASL SQL plugin incorrectly handled SQL
input. A remote attacker could use this issue to execute arbitrary SQL
commands.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 21.10

• libsasl2-modules-sql - 2.1.27+dfsg-2.1ubuntu0.1

Ubuntu 20.04

• libsasl2-modules-sql - 2.1.27+dfsg-2ubuntu0.1

Ubuntu 18.04

• libsasl2-modules-sql - 2.1.27~101-g0780600+dfsg-3ubuntu2.4

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

• CVE-2022-24407

Related notices

• USN-5301-2: libsasl2-modules-gssapi-mit, sasl2-bin, libsasl2-modules-gssapi-heimdal, libsasl2-modules-otp, cyrus-sasl2-doc, libsasl2-modules-sql, cyrus-sasl2, libsasl2-dev, libsasl2-modules, libsasl2-modules-db, libsasl2-2, libsasl2-modules-ldap