CVE-2008-2380
courier-authlib - sql injection
EPSS 1.8%
Description
SQL injection vulnerability in authpgsqllib.c in Courier-Authlib before 0.62.0, when a non-Latin locale Postgres database is used, allows remote attackers to execute arbitrary SQL commands via query parameters containing apostrophes.
How to fix CVE-2008-2380
To remediate CVE-2008-2380, upgrade the affected package to a fixed version below.
- Debian/courier-authlib—upgrade to 0.61.0-1+lenny1 or later
- Debian/courier-authlib—upgrade to 0.58-4+etch2 or later
- Debian/courier-authlib—upgrade to 0.61.0-1+lenny1 or later
Is CVE-2008-2380 being exploited?
Low — EPSS is 1.8%, meaning exploitation activity has not been observed at scale.
Affected packages (3)
- from 0, < 0.61.0-1+lenny1
- from 0, < 0.58-4+etch2
- from 0, < 0.61.0-1+lenny1