| Package | Affected versions | Patched versions |
|---|---|---|
| sasl | = 1.5.24= 1.5.27= 1.5.28= 2.1.10= 2.1.11= 2.1.12= 2.1.13= 2.1.14= 2.1.15= 2.1.16= 2.1.17= 2.1.18= 2.1.18_r1= 2.1.9 |
The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free