[IT-SecNots] [SECURITY] [DSA 5087-1] cyrus-sasl2 security update

[Salvatore Bonaccorso <carnil AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-5087-1                   security AT debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
February 25, 2022                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : cyrus-sasl2
CVE ID         : CVE-2022-24407

It was discovered that the SQL plugin in cyrus-sasl2, a library
implementing the Simple Authentication and Security Layer, is prone to a
SQL injection attack. An authenticated remote attacker can take
advantage of this flaw to execute arbitrary SQL commands and for
privilege escalation.

For the oldstable distribution (buster), this problem has been fixed
in version 2.1.27+dfsg-1+deb10u2.

For the stable distribution (bullseye), this problem has been fixed in
version 2.1.27+dfsg-2.1+deb11u1.

We recommend that you upgrade your cyrus-sasl2 packages.

For the detailed security status of cyrus-sasl2 please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/cyrus-sasl2

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmIZVw9fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0SKYxAAho3dEbjC//m2kbMP1qZv/9vurrjc8HEwYGeAZFUv270wg67AHk/5XJow
UhkeLbFYRwA3WrwvFVuGPWPev3vKxn5dyy9A5s9N6rcl2Izi12g7NmGC3ihd/Gdo
wBtoOTJhV95iSyv8CfY0Fc7Fszgi7yqnAPAO3k/q+Nf0Gw4U2K7te9RmsR/eD0p5
iH0x+WliE4z4ZSOrbysiDxy/3UEJDjTP3smsfB8l5XME0cXtxfzuukdUzBbGsP5Z
hxR0TOE6YjA+81W+NYsJniBKfupBXPsVwPcltPZBDFnrnWygcSt5n2y7sOosudLe
JY9VHHmqNZNIc1/BywMTNtFcWbXaUAglaXucoYo+OreOvKtp2faSNDwA5JUwrgJ4
gKbhilASS+kXXybc6OUavEbncFWJaSDENaRol5NzlAaGSnuwfxIpjIc54NwdERah
45JGLLIl+R8Psz2/UEPgm629NuJ5y76nkKCE3/H6hTP2NJg08OKaplg5Ak8vyubr
I/dbBKq5qV/yW9anp9Y1HCdrvQLhuI/TrEtR1e0oG161IbTikbLHk2+xSdMsIFDL
+WwOqzMAM1I2zOB9m9ejs2ToIq6fynPJJrEczDn0IDLRib/wmdM08lJnAc60Sj9m
1JXV34BujSxYVJDdxAfR79M7HeBObJA7MsEPygtaKP4Lh5pr3BQ=
=mI2X
-----END PGP SIGNATURE-----