PatchTheCVEcyrus-sasl vulnerabilities and fixes
Recent CVEs affecting cyrus-sasl, with upgrade or downgrade steps. 5 tracked.
Also searched as: cyrus sasl.
cyrus-sasl has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2022-02-24. Highest priority: CVE-2019-19906 (score 65/100).
- CVE-2022-24407 HIGH 8.8 UPGRADE MITIGATE In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT
- CVE-2019-19906 HIGH 7.5 UPGRADE MITIGATE cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-serv
- CVE-2020-8032 MEDIUM 6.7 UPGRADE A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attack
- CVE-2013-4122 MEDIUM 4.3 UPGRADE Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by
- CVE-2009-0688 HIGH 7.5 UPGRADE Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute
FAQ
How do I fix cyrus-sasl vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is cyrus-sasl being exploited right now?
None of the tracked cyrus-sasl CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which cyrus-sasl CVE should I patch first?
CVE-2019-19906 currently ranks highest (65/100): cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-serv.