cyrusimap

cyrus-sasl

2 known vulnerabilities · sorted by CVSS score

CVE-2022-24407

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

cyrusimap / cyrus-sasl+11

Network

Published Feb 24, 2022

CVE-2019-19906

HIGH7.5

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.

cyrusimap / cyrus-sasl+53

Network

Published Dec 19, 2019