- -------------------------------------------------------------------------
Debian Security Advisory DSA-5087-1                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
February 25, 2022                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : cyrus-sasl2
CVE ID         : CVE-2022-24407

It was discovered that the SQL plugin in cyrus-sasl2, a library
implementing the Simple Authentication and Security Layer, is prone to a
SQL injection attack. An authenticated remote attacker can take
advantage of this flaw to execute arbitrary SQL commands and for
privilege escalation.

For the oldstable distribution (buster), this problem has been fixed
in version 2.1.27+dfsg-1+deb10u2.

For the stable distribution (bullseye), this problem has been fixed in
version 2.1.27+dfsg-2.1+deb11u1.

We recommend that you upgrade your cyrus-sasl2 packages.

For the detailed security status of cyrus-sasl2 please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/cyrus-sasl2

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org