Overview
The Sophos UTM 9.710 MR10 release contains several fixes for security vulnerabilities:
|
CVE ID |
Description |
Severity |
|---|---|---|
|
CVE-2022-0386 |
A post-auth SQL injection vulnerability in the Mail Manager of Sophos UTM was discovered by Sophos during internal security testing. The remediation prevented an authenticated user from being able to potentially execute code. |
HIGH |
|
CVE-2022-0652 |
Confd log files contained local users', including root’s, SHA512crypt password hashes with insecure access permissions, which Sophos discovered during internal security testing. The remediation prevented the hashes from being written to the logs and prevented a local attacker from attempting off-line brute-force attacks against these password hashes. |
LOW |
Applies to the following Sophos product(s) and version(s)
-
Sophos UTM
Remediation
-
Fixes included in Sophos UTM v9.710 MR10 on March 9, 2022
-
Users of older versions of Sophos UTM are required to upgrade to receive this fix
-
Sophos always recommends that Sophos UTM customers upgrade to the latest available release at their earliest opportunity