CVE-2022-24407

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-24407
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24407.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-24407
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CLEANSTART (1)
CLSA (5)
DEBIAN (1)
MGASA (2)
OESA (1)
openSUSE (2)
RHSA (8)
RLSA (1)
SUSE (6)
UBUNTU (1)
Related
ALSA (1)
openSUSE (2)
SUSE (6)
Published
2022-02-23T00:00:00Z
Modified
2026-08-12T13:00:28Z
Summary
[none]
Details

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24407.json"
}
References

Affected packages

Git / github.com/cyrusimap/cyrus-sasl

Affected ranges

Type
GIT
Repo
https://github.com/cyrusimap/cyrus-sasl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0189425cc210555c36383293c468df5da73acc48
Fixed
7a6b45b177070198fed0682bea5fa87c18abb084
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.1.17"
        },
        {
            "fixed":  "2.1.27"
        },
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.1.28"
        }
    ],
    "source":  "DESCRIPTION"
}

Affected versions

cyrus-sasl-2.*
cyrus-sasl-2.1.23
cyrus-sasl-2.1.24
cyrus-sasl-2.1.25
cyrus-sasl-2.1.26
cyrus-sasl-2.1.27

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24407.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "186791996052852124502521635320733420169",
            "length":  1554
        },
        "id":  "CVE-2022-24407-5c873e4e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/cyrusimap/cyrus-sasl/commit/0189425cc210555c36383293c468df5da73acc48",
        "target":  {
            "file":  "plugins/ldapdb.c",
            "function":  "ldapdb_connect"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "144668858640807075656085101226286271128",
                "211578268953532869409335602825794959431",
                "96446337139993211718298955984275164381",
                "167226722289251606297342675712617793056",
                "206595935989217991224862346054111721781",
                "50557079708634351328870234884447350999",
                "184652442851362552426685588654803768615",
                "43876264774750258202720770410034814538"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-24407-6810885d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/cyrusimap/cyrus-sasl/commit/0189425cc210555c36383293c468df5da73acc48",
        "target":  {
            "file":  "plugins/ldapdb.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "330803884472733918276636343244308402752",
            "length":  2959
        },
        "id":  "CVE-2022-24407-def92cbb",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/cyrusimap/cyrus-sasl/commit/0189425cc210555c36383293c468df5da73acc48",
        "target":  {
            "file":  "plugins/ldapdb.c",
            "function":  "ldapdb_auxprop_lookup"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T13:00:28Z"