Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 833926 (CVE-2022-24407) - <dev-libs/cyrus-sasl-2.1.28: SQL injection vulnerability in password
Summary: <dev-libs/cyrus-sasl-2.1.28: SQL injection vulnerability in password
Status: RESOLVED FIXED
Alias: CVE-2022-24407
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [noglsa]
Keywords: PullRequest
Depends on: 835522
Blocks:
  Show dependency tree
 
Reported: 2022-02-23 02:31 UTC by Sam James
Modified: 2022-04-29 10:23 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-02-23 02:31:53 UTC
From 2.1.28 release notes (https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst):
>sql.c:
>CVE-2022-24407 Escape password for SQL insert/update commands.
Comment 1 Larry the Git Cow gentoo-dev 2022-04-29 10:21:50 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e4bf2b51946b76b7a6ce7fc50943f492075468c6

commit e4bf2b51946b76b7a6ce7fc50943f492075468c6
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-04-29 09:40:57 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-04-29 10:20:43 +0000

    dev-libs/cyrus-sasl: drop 2.1.27-r7
    
    Bug: https://bugs.gentoo.org/833926
    Signed-off-by: Sam James <sam@gentoo.org>

 dev-libs/cyrus-sasl/Manifest                    |   1 -
 dev-libs/cyrus-sasl/cyrus-sasl-2.1.27-r7.ebuild | 260 ------------------------
 2 files changed, 261 deletions(-)