Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
cyrus-sasl may let attackers bypass authentication
published 2 years ago
Summary
Several Red Hat cyrus-sasl packages—including debugging and development versions—contain a weakness that could allow an attacker to bypass authentication mechanisms. This could let unauthorized users gain access to services that rely on SASL for security. Apply the latest Red Hat security update for the cyrus-sasl packages as soon as possible to close the gap.
What to do
- Update redhat cyrus-sasl-debuginfo to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-debugsource to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-devel-debuginfo to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-gs2-debuginfo to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-gssapi-debuginfo to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-ldap-debuginfo to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-lib-debuginfo to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-md5-debuginfo to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-ntlm-debuginfo to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-plain-debuginfo to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-scram-debuginfo to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-sql to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-sql-debuginfo to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-devel to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-gs2 to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-gssapi to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-ldap to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-lib to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-md5 to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-ntlm to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-plain to version 0:2.1.27-2.el8_2.
- Update redhat cyrus-sasl-scram to version 0:2.1.27-2.el8_2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_eus:8.2::appstream | redhat | cyrus-sasl-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::appstream | redhat | cyrus-sasl-debugsource |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::appstream | redhat | cyrus-sasl-devel-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::appstream | redhat | cyrus-sasl-gs2-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::appstream | redhat | cyrus-sasl-gssapi-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::appstream | redhat | cyrus-sasl-ldap-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::appstream | redhat | cyrus-sasl-lib-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::appstream | redhat | cyrus-sasl-md5-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::appstream | redhat | cyrus-sasl-ntlm-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::appstream | redhat | cyrus-sasl-plain-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::appstream | redhat | cyrus-sasl-scram-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::appstream | redhat | cyrus-sasl-sql |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::appstream | redhat | cyrus-sasl-sql-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-debugsource |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-devel |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-devel-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-gs2 |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-gs2-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-gssapi |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-gssapi-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-ldap |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-ldap-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-lib |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-lib-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-md5 |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-md5-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-ntlm |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-ntlm-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-plain |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-plain-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-scram |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-scram-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
| Red Hat:rhel_eus:8.2::baseos | redhat | cyrus-sasl-sql-debuginfo |
< 0:2.1.27-2.el8_2 Fix: upgrade to 0:2.1.27-2.el8_2
|
Original advisory text
Red Hat Security Advisory: cyrus-sasl security update
References
- https://access.redhat.com/errata/RHSA-2022:0731 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2055326 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0731.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-24407 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-24407 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-24407 Vendor Advisory
- https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published13 Sep 2024
Updated21 Oct 2026
First seen21 Oct 2026
Sources
RHSA-2022:0731 · OSV
Track software like this
Free during beta