Bug 833926 (CVE-2022-24407)

Summary:	<dev-libs/cyrus-sasl-2.1.28: SQL injection vulnerability in password
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	maintainer-needed
Priority:	Normal	Keywords:	PullRequest
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://github.com/gentoo/gentoo/pull/25251
Whiteboard:	B3 [noglsa]
Package list:		Runtime testing required:	---
Bug Depends on:	835522
Bug Blocks:

Description Sam James archtester

2022-02-23 02:31:53 UTC

From 2.1.28 release notes (https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst):
>sql.c:
>CVE-2022-24407 Escape password for SQL insert/update commands.

Comment 1 Larry the Git Cow gentoo-dev

2022-04-29 10:21:50 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e4bf2b51946b76b7a6ce7fc50943f492075468c6

commit e4bf2b51946b76b7a6ce7fc50943f492075468c6
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-04-29 09:40:57 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-04-29 10:20:43 +0000

    dev-libs/cyrus-sasl: drop 2.1.27-r7
    
    Bug: https://bugs.gentoo.org/833926
    Signed-off-by: Sam James <sam@gentoo.org>

 dev-libs/cyrus-sasl/Manifest                    |   1 -
 dev-libs/cyrus-sasl/cyrus-sasl-2.1.27-r7.ebuild | 260 ------------------------
 2 files changed, 261 deletions(-)