Cyrusimap Cyrus Sasl vulnerabilities

2 vulnerabilities

Known vulnerabilities in Cyrusimap Cyrus Sasl, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8CVE-2022-24407alpinecyrus-sasl+114
EPSS score
4.12%
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.7.5CVE-2019-19906apachebookkeeper+107
EPSS score
8.04%
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.