Your message dated Fri, 16 Oct 2026 21:40:45 +0000
with message-id <[email protected]>
and subject line Bug#1150516: fixed in cyrus-sasl2 2.1.28+dfsg1-12
has caused the Debian Bug report #1150516,
regarding cyrus-sasl2: CVE-2026-107161
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150516: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150516
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: cyrus-sasl2
Version: 2.1.28+dfsg1-11
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Forwarded: https://github.com/cyrusimap/cyrus-sasl/issues/889
Hi,
The following vulnerability was published for cyrus-sasl2.
CVE-2026-107161[0]:
| A heap-based buffer overflow flaw was found in Cyrus SASL. The
| add_to_challenge() function in the DIGEST-MD5 plugin computes the
| size of the buffer needed for a challenge/response field before
| DIGEST-MD5 quoting is applied, but does not recompute that size when
| quoting (escaping special characters) makes the value longer. The
| under-sized buffer is then passed to strcat(), causing a heap-based
| out-of-bounds write whose size depends on attacker-controlled input.
| A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can
| trigger this flaw in a connecting client by supplying a crafted
| challenge field, such as realm or nonce, most likely resulting in a
| crash of the client application.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-107161
https://www.cve.org/CVERecord?id=CVE-2026-107161
[1] https://github.com/cyrusimap/cyrus-sasl/issues/889
[2] https://github.com/cyrusimap/cyrus-sasl/pull/892
[3] https://bugzilla.redhat.com/show_bug.cgi?id=2460420
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: cyrus-sasl2
Source-Version: 2.1.28+dfsg1-12
Done: Bastian Germann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
cyrus-sasl2, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bastian Germann <[email protected]> (supplier of updated cyrus-sasl2 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 16 Oct 2026 23:04:01 +0200
Source: cyrus-sasl2
Architecture: source
Version: 2.1.28+dfsg1-12
Distribution: unstable
Urgency: medium
Maintainer: Debian Cyrus Team <[email protected]>
Changed-By: Bastian Germann <[email protected]>
Closes: 1150516
Changes:
cyrus-sasl2 (2.1.28+dfsg1-12) unstable; urgency=medium
.
* Team upload
* Add CVE-2026-107161 regression test
* Add the CVE-2026-107161 report's suggested fix (Closes: #1150516)
.
[ Peter Wienemann ]
* Add RuntimeDirectoryMode=0710 to d/sasl2-bin.saslauthd.service
Checksums-Sha1:
6ec0729fecd57ed8146e620ed1ec08b8bbdf43aa 3484 cyrus-sasl2_2.1.28+dfsg1-12.dsc
735f3bfc228c371068e838f6182c5caba0e734eb 104996
cyrus-sasl2_2.1.28+dfsg1-12.debian.tar.xz
a66a237084af3315ad6bb944736dd2cc4d37ee1f 5518
cyrus-sasl2_2.1.28+dfsg1-12_source.buildinfo
Checksums-Sha256:
caf1da13a075f72af055d3f2c658bec5d9e484202cb0e7c85755e7b6cdc9eb7d 3484
cyrus-sasl2_2.1.28+dfsg1-12.dsc
5aef55aa41fad421aed3fa1cf1f79ecb9db82534220c6211d64383ae5f39e20f 104996
cyrus-sasl2_2.1.28+dfsg1-12.debian.tar.xz
c34e17ae56b6526751085f8cb1cae46469b8dd213b2fbc7cbdb5a1869cb9ab87 5518
cyrus-sasl2_2.1.28+dfsg1-12_source.buildinfo
Files:
db70385b37709a79bb905dd324a2c678 3484 libs optional
cyrus-sasl2_2.1.28+dfsg1-12.dsc
ea2b1fa8dbf56f219274705b2e83f8f2 104996 libs optional
cyrus-sasl2_2.1.28+dfsg1-12.debian.tar.xz
06abc45ca77d946a6848aea76321fc66 5518 libs optional
cyrus-sasl2_2.1.28+dfsg1-12_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAmrSkZIQHGJhZ2VAZGVi
aWFuLm9yZwAKCRAfXHqLRVZDFJWKDADeXApFa4cpKcv7vEFZncWZuA1gZru9eto8
BFyVK0n2a7ZJLkQ8sZq3KngDYLbF2/sPxnzLfFggmrVcKZsMC2lDHwFx/J9PGYdR
goGgovXWDeBBYy/NMubqo8c+i28prw39qpKsjn5i81OAwkTU7qEzeb0WPXL+grmJ
FnchxVe6NhQGPMFbO6WIKNbaB8JUqJejpR4+tWk0gbsKmdDs01laOZ6E2kUam0/2
ZctXjB1YJSUmEXFdfxonPiplLRawSsb4eGLPoy334/chRdynzTHedj9RaRvUlmUo
bvWkHDcsLpmtwtYb+eXvJKLbc7MgTzBIpYwQQJEyoQLG3iKf9NXdz4NKgwTuOUaX
4qzrRxRwp1OT3bQYErzTm3rVqtcQul3f8rf3RVRwQscZMWejncl40/mCp8gPqU9Z
c1yGQqwZ8wjuC2Hd4MY+Y9GuoxDOsArwpEjrth3644GRWAbKxmUVKWkNloWpge6r
ykdagfSIvCtkJKTw3bzP2Pk675MpBSk=
=tVgz
-----END PGP SIGNATURE-----
pgpiTfD1QEPtq.pgp
Description: PGP signature
--- End Message ---
