Source: cyrus-sasl2 Version: 2.1.28+dfsg1-11 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream Forwarded: https://github.com/cyrusimap/cyrus-sasl/issues/889
Hi, The following vulnerability was published for cyrus-sasl2. CVE-2026-107161[0]: | A heap-based buffer overflow flaw was found in Cyrus SASL. The | add_to_challenge() function in the DIGEST-MD5 plugin computes the | size of the buffer needed for a challenge/response field before | DIGEST-MD5 quoting is applied, but does not recompute that size when | quoting (escaping special characters) makes the value longer. The | under-sized buffer is then passed to strcat(), causing a heap-based | out-of-bounds write whose size depends on attacker-controlled input. | A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can | trigger this flaw in a connecting client by supplying a crafted | challenge field, such as realm or nonce, most likely resulting in a | crash of the client application. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-107161 https://www.cve.org/CVERecord?id=CVE-2026-107161 [1] https://github.com/cyrusimap/cyrus-sasl/issues/889 [2] https://github.com/cyrusimap/cyrus-sasl/pull/892 [3] https://bugzilla.redhat.com/show_bug.cgi?id=2460420 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
