Unfixed vulnerabilities in Cyrus SASL
Publicly reported Cyrus SASL security issues remain unfixed, with no maintainer response and no release since 2022.
Alan Coopersmith highlighted a GitHub issue documenting multiple publicly reported security problems in Cyrus SASL and no response from current maintainers. Former maintainers said they are no longer involved. The project has had no new version since 2022, and commits in the past year were documentation updates noting cyrus-imapd releases. The open issues include memory leaks in _sasl_make_plain_secret.
- Multiple publicly reported Cyrus SASL security issues remain open.
- Maintainers have not responded; former maintainers say they left.
- No new release since 2022; recent commits are documentation only.
- Reported flaws include memory leaks in _sasl_make_plain_secret.
From the original article
Posted by Alan Coopersmith on Oct 09 https://github. com/cyrusimap/cyrus-sasl/issues/891 points out there are a number of publicly reported security issues in the Cyrus SASL project, with no response from maintainers, other than former maintainers saying they are no longer involved; no new version since 2022, and the only commits in the past year being doc updates to note cyrus-imapd releases.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.