RHSA-2022:0780: Important: cyrus-sasl security update
The cyrus-sasl packages contain the Cyrus implementation of Simple Authentication and Security Layer (SASL). SASL is a method for adding authentication support to connection-based protocols.Security Fix(es): cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands (CVE-2022-24407) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:0780?
RHSA-2022:0780 has a moderate severity rating due to SQL injection risks associated with cyrus-sasl.
How do I fix RHSA-2022:0780?
To fix RHSA-2022:0780, update cyrus-sasl packages to version 2.1.23-16.el6_10.
What software is affected by RHSA-2022:0780?
RHSA-2022:0780 affects various cyrus-sasl packages including cyrus-sasl, cyrus-sasl-devel, and cyrus-sasl-ldap.
What is the main vulnerability described in RHSA-2022:0780?
The main vulnerability in RHSA-2022:0780 is the failure to properly escape SQL input within the cyrus-sasl packages.
Is there a specific version I need to upgrade to for RHSA-2022:0780?
Yes, you need to upgrade to version 2.1.23-16.el6_10 to resolve the issues related to RHSA-2022:0780.