CVE-2022-2469 Memory corruption in GNU SASL

Low 3.8 Published 19 Jul 2022 Updated 3 Aug 2024

A malicious authenticated GSS-API client can trigger an out-of-bounds read in the GNU SASL server, potentially causing a crash or information disclosure.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-2469?

CVE-2022-2469 is a low-severity memory corruption vulnerability in Debian Debian Linux, published on 19 Jul 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

Weakness: CWE-125

Which versions are affected by CVE-2022-2469?

It affects 2 products.

Linux distribution packages (6)

`libgsasl` SUSE:Manager Proxy Module 4.1	All versions	`1.8.0-150200.3.3.1`
`libgsasl` SUSE:Manager Proxy Module 4.2	All versions	`1.8.0-150300.3.3.1`
`libgsasl` SUSE:Manager Proxy Module 4.3	All versions	`1.8.0-150400.3.3.1`
`libgsasl` SUSE:Manager Server Module 4.1	All versions	`1.8.0-150200.3.3.1`
`libgsasl` SUSE:Manager Server Module 4.2	All versions	`1.8.0-150300.3.3.1`
`libgsasl` SUSE:Manager Server Module 4.3	All versions	`1.8.0-150400.3.3.1`

Products include Debian Debian Linux, Gnu Gnu Sasl.

How do I fix CVE-2022-2469?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-2469 being exploited?

There is no known exploitation of CVE-2022-2469 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-2469, DSA-5189-1, GHSA-r9xr-xfwx-6crw, MGASA-2022-0298, OESA-2024-1351, OESA-2024-1441 and 11 more.