DSA-5087: -1 cyrus-sasl2 -- security update
cyrus-sasl2 - security update
Other sources
It was discovered that the SQL plugin in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer, is prone to a SQL injection attack. An authenticated remote attacker can take advantage of this flaw to execute arbitrary SQL commands and for privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cyrus-sasl2to a version that resolves this vulnerability.Patch DSA-5087-1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to reach a service using the cyrus-sasl2 SQL plugin remotely. The flaw may allow that attacker to execute arbitrary SQL commands and escalate privileges.
Are all cyrus-sasl2 deployments affected?
The issue is described specifically in the SQL plugin. The provided information does not establish whether installations that do not use that plugin are affected.
What is the potential impact after exploitation?
Successful exploitation can permit arbitrary SQL command execution. It may also enable privilege escalation.