Netatalk SQL Injection Vulnerability in MySQL CNID Backend

A SQL injection vulnerability has been identified in the MySQL CNID backend of Netatalk versions 3.1.0 prior to 4.4.2. This vulnerability allows authenticated AFP clients to manipulate database queries, potentially compromising the confidentiality, integrity, or availability of the CNID database.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of SQL commands, allowing attackers to manipulate the CNID database in ways that could compromise its confidentiality, integrity, or availability.

Remediation

Users can upgrade to Netatalk version 4.4.3 or later, which includes the necessary patch. Alternatively, the patch can be applied to a Netatalk 4.4.2 source tree. Netatalk administrators are advised to upgrade or apply the patch as soon as possible.