package libsasl2-modules provides only unsafe SASL bind mechanims

[rdratlos]

[ Impact ]

The SASL SCRAM mechanism is incorrectly part of the libsasl2-modules-gssapi-mit package. It has nothing to do with MIT or GSSAPI, and should be in libsasl2-modules.

Normally this would just be an annoyance, but it just so happens that this also prevents to have the SCRAM mechanism coexist with the GSSAPI Heimdal one, because libsasl2-modules-gssapi-{mit,heimdal} conflict with each other.

This change is moving a file from one package to another, so appropriate breaks/replaces changes have to be made. This move follows case #10 from the package transition table[1].

[ Test Plan ]

This test plan revolves around dependency checking and upgrades, to make sure we don't:
- have conflicting files which would break an upgrade
- have no loss of functionality after an upgrade (since a plugin moved between packages)

a) SCRAM remains installed
# Install the package that provides SCRAM in jammy

$ sudo apt install libsasl2-modules-gssapi-mit

# Confirm mechanism is there and belongs to libsasl2-modules-gssapi-mit:

$ ll /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
lrwxrwxrwx 1 root root 18 Aug 16 20:08 /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2 -> libscram.so.2.0.25

$ dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
libsasl2-modules-gssapi-mit:amd64: /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2

# list installed sasl2 packages:
$ dpkg -l | grep -E "^ii.*sasl2" | awk '{print $2,$3}'
libsasl2-2:amd64 2.1.27+dfsg2-3ubuntu1.1
libsasl2-modules:amd64 2.1.27+dfsg2-3ubuntu1.1
libsasl2-modules-db:amd64 2.1.27+dfsg2-3ubuntu1.1
libsasl2-modules-gssapi-mit:amd64 2.1.27+dfsg2-3ubuntu1.1

# dist-upgrade or install the new sasl2 packages from proposed
# Confirm the same packages are installed as before the upgrade, just at their newer versions:
libsasl2-2:amd64 2.1.27+dfsg2-3ubuntu1.2
libsasl2-modules:amd64 2.1.27+dfsg2-3ubuntu1.2
libsasl2-modules-db:amd64 2.1.27+dfsg2-3ubuntu1.2
libsasl2-modules-gssapi-mit:amd64 2.1.27+dfsg2-3ubuntu1.2

# Confirm the scram mechanism is still there, as before:

$ ll /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
lrwxrwxrwx 1 root root 18 Aug 16 20:08 /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2 -> libscram.so.2.0.25

# But now it belongs to the libsasl2-modules package:
$ dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
libsasl2-modules:amd64: /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2

b) Following (a), perform a release-upgrade to kinetic, and confirm that the same sasl2 packages remain installed, but now at the kinetic version:

$ dpkg -l | grep -E "^ii.*sasl2" | awk '{print $2,$3}'
libsasl2-2:amd64 2.1.28+dfsg-6ubuntu2
libsasl2-modules:amd64 2.1.28+dfsg-6ubuntu2
libsasl2-modules-db:amd64 2.1.28+dfsg-6ubuntu2
libsasl2-modules-gssapi-mit:amd64 2.1.28+dfsg-6ubuntu2

And that the scram mechanism is there, and still belongs to the libsasl2-modules package:

$ ll /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
lrwxrwxrwx 1 root root 18 Aug 16 20:08 /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2 -> libscram.so.2.0.25

$ dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
libsasl2-modules:amd64: /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2

c) A jammy system WITHOUT the SCRAM mechanism available (i.e., libsasl2-modules-gssapi-mit is NOT installed), will get SCRAM available after the upgrade, but without installing any new package.

# Start with these sasl2 packages installed on jammy:

libsasl2-2:amd64 2.1.27+dfsg2-3ubuntu1.1
libsasl2-modules:amd64 2.1.27+dfsg2-3ubuntu1.1
libsasl2-modules-db:amd64 2.1.27+dfsg2-3ubuntu1.1

# Confirm SCRAM is not installed:
$ ll /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
ls: cannot access '/usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2': No such file or directory

# Upgrade to the packages in proposed
# Confirm no new sasl2 packages were installed:

$ dpkg -l | grep -E "^ii.*sasl2" | awk '{print $2,$3}'
libsasl2-2:amd64 2.1.27+dfsg2-3ubuntu1.2
libsasl2-modules:amd64 2.1.27+dfsg2-3ubuntu1.2
libsasl2-modules-db:amd64 2.1.27+dfsg2-3ubuntu1.2

# Verify that SCRAM is now available, and part of the libsasl2-modules package:
$ ll /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
lrwxrwxrwx 1 root root 18 Aug 16 20:08 /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2 -> libscram.so.2.0.25

$ dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
libsasl2-modules:amd64: /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2

# Perform a release upgrade to kinetic, and confirm that no new sasl2 package is installed, and that the SCRAM mechanism remains available as before, belonging to the libsasl2-modules package.

d) It's now possible to have SCRAM and gssapi heimdal mechanisms installed at the same time

# On jammy, install libsasl2-modules-gssapi-mit so that you have SCRAM available:
$ sudo apt install libsasl2-modules-gssapi-mit

# Confirm SCRAM is available and part of the libsasl2-modules-gssapi-mit package:

$ ll /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
lrwxrwxrwx 1 root root 18 Feb 22 2022 /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2 -> libscram.so.2.0.25

$ dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
libsasl2-modules-gssapi-mit:amd64: /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2

# If you try to install libsasl2-modules-gssapi-heimdal, you will lose the SCRAM mechanism because libsasl2-modules-gssapi-mit will be removed:

$ sudo apt install libsasl2-modules-gssapi-heimdal
(...)
The following packages will be REMOVED:
  libsasl2-modules-gssapi-mit
(...)

$ dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
dpkg-query: no path found matching pattern /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2

# IF, however, the above is attempted with the sasl2 packages from proposed available, then, even though libsasl2-modules-gssapi-mit is still removed, libsasl2-modules will be upgraded, and that will include the SCRAM mechanism:

$ sudo apt install libsasl2-modules-gssapi-heimdal
(...)
The following packages will be REMOVED:
  libsasl2-modules-gssapi-mit
(...)
The following packages will be upgraded:
  libsasl2-modules

# And in the end we have libsasl2-modules and libsasl2-modules-gssapi-heimdal installed, and SCRAM available:

$ dpkg -l | grep sasl2 | awk '{print $2,$3}'
libsasl2-2:amd64 2.1.27+dfsg2-3ubuntu1.1
libsasl2-modules:amd64 2.1.27+dfsg2-3ubuntu1.2
libsasl2-modules-db:amd64 2.1.27+dfsg2-3ubuntu1.1
libsasl2-modules-gssapi-heimdal:amd64 2.1.27+dfsg2-3ubuntu1.2

$ dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
libsasl2-modules:amd64: /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2

# A release upgrade to kinetic must not change this situation, besides the versions of the packages.

$ dpkg -l | grep sasl2 | awk '{print $2,$3}'
libsasl2-2:amd64 2.1.28+dfsg-6ubuntu2
libsasl2-modules:amd64 2.1.28+dfsg-6ubuntu2
libsasl2-modules-db:amd64 2.1.28+dfsg-6ubuntu2
libsasl2-modules-gssapi-heimdal:amd64 2.1.28+dfsg-6ubuntu2

$ dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
libsasl2-modules:amd64: /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2

[ Where problems could occur ]

Since this change is moving a file from one package to the other, the problems that could occur will most likely be related to dependencies, and failures to install the packages because of file conflicts. Another possibility is problems during release upgrades, also related to conflicting files. Finally, another possible issue would be users who had certain SASL mechanisms installed before, be without them after the upgrade.

The test plan tries to cover the above scenarios.

[ Other Info ]

This change comes from debian's 2.1.28+dfsg-4[2] upload, and is applied in kinetic and later.

1. https://wiki.debian.org/PackageTransition
2. https://salsa.debian.org/debian/cyrus-sasl2/-/commit/510c86097b7259f0033150c5a66115028736c157

[Original Description]

Current Cyrus libsasl2 packaging (Ubuntu Jammy) distributes SASL bind mechanims into different packages. Plained and shared secret mechanisms are provided by package libsasl2-modules:
/usr/lib/x86_64-linux-gnu/sasl2/libanonymous.so
/usr/lib/x86_64-linux-gnu/sasl2/libanonymous.so.2
/usr/lib/x86_64-linux-gnu/sasl2/libanonymous.so.2.0.25
/usr/lib/x86_64-linux-gnu/sasl2/libcrammd5.so
/usr/lib/x86_64-linux-gnu/sasl2/libcrammd5.so.2
/usr/lib/x86_64-linux-gnu/sasl2/libcrammd5.so.2.0.25
/usr/lib/x86_64-linux-gnu/sasl2/libdigestmd5.so
/usr/lib/x86_64-linux-gnu/sasl2/libdigestmd5.so.2
/usr/lib/x86_64-linux-gnu/sasl2/libdigestmd5.so.2.0.25
/usr/lib/x86_64-linux-gnu/sasl2/liblogin.so
/usr/lib/x86_64-linux-gnu/sasl2/liblogin.so.2
/usr/lib/x86_64-linux-gnu/sasl2/liblogin.so.2.0.25
/usr/lib/x86_64-linux-gnu/sasl2/libntlm.so
/usr/lib/x86_64-linux-gnu/sasl2/libntlm.so.2
/usr/lib/x86_64-linux-gnu/sasl2/libntlm.so.2.0.25
/usr/lib/x86_64-linux-gnu/sasl2/libplain.so
/usr/lib/x86_64-linux-gnu/sasl2/libplain.so.2
/usr/lib/x86_64-linux-gnu/sasl2/libplain.so.2.0.25

The "safest" mechanism in this list is DIGEST-MD5, which is marked as obsolete by IANA and regarded as unsafe by IETF. Current safest standard mechanisms are SCRAM based (RFC7677).

All SCRAM family SASL mechanisms of Cyrus SASL are provided by Ubuntu package libsasl2-modules-gssapi-mit:
/usr/lib/x86_64-linux-gnu/sasl2/libscram.so
/usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
/usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2.0.25

But the focus of this package is GSSAPI and GS2 SASL mechanism, which have nothing to do with SCRAM. In addition, this package conflicts with package libsasl2-modules-gssapi-heimdal. System administrators have to choose one package for support of GSSAPI or GSS-SPEGNO. If they prefer Heimdal there is no safe SASL shared secret mechanism available anymore on the server/workstation.

[rdratlos (rdratlos)]

Attached patch adds SCRAM family mechanisms to the SASL shared secret mechanims package. It has been tested on an LDAP client in three configurations:
- libsasl2-modules-gssapi-* not installed
- libsasl2-modules-gssapi-mit installed
- libsasl2-modules-gssapi-heimdal installed

For the latter two configurations also GSSAPI SASL authentication has been tested.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "Fix SCRAM support for SASL authentication" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Lucas Kanashiro (lucaskanashiro)]

Thanks for taking the time to report this bug and trying to make Ubuntu better.

This very same bug was filed against Debian:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=977360

and fixed by this commit in version 2.1.28+dfsg-4:

https://salsa.debian.org/debian/cyrus-sasl2/-/commit/510c86097b7259f0033150c5a66115028736c157

We need to backport the patch above to Jammy to address this issue.

[Chris Halse Rogers (raof)]

Hello rdratlos, or anyone else affected,

Accepted cyrus-sasl2 into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/cyrus-sasl2/2.1.27+dfsg2-3ubuntu1.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Jammy verification, test by test. First, (a):

a) SCRAM remains installed
Installed libsasl2-modules-gssapi-mit package from jammy, and confirmed scram is part of it:
ubuntu@j-sasl-scram:~$ ll /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
lrwxrwxrwx 1 root root 18 Oct 19 21:06 /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2 -> libscram.so.2.0.25
ubuntu@j-sasl-scram:~$ dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
libsasl2-modules-gssapi-mit:amd64: /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
ubuntu@j-sasl-scram:~$ apt-cache policy libsasl2-modules-gssapi-mit
libsasl2-modules-gssapi-mit:
  Installed: 2.1.27+dfsg2-3ubuntu1.1
  Candidate: 2.1.27+dfsg2-3ubuntu1.1
  Version table:
 *** 2.1.27+dfsg2-3ubuntu1.1 500
        500 http://br.archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     2.1.27+dfsg2-3ubuntu1 500
        500 http://br.archive.ubuntu.com/ubuntu jammy/main amd64 Packages

Updated to the packages from proposed:
$ sudo apt install libsasl2-2 libsasl2-modules libsasl2-modules-db libsasl2-modules-gssapi-mit
...
$ dpkg -l | grep -E "^ii.*sasl2" | awk '{print $2,$3}'
libsasl2-2:amd64 2.1.27+dfsg2-3ubuntu1.2
libsasl2-modules:amd64 2.1.27+dfsg2-3ubuntu1.2
libsasl2-modules-db:amd64 2.1.27+dfsg2-3ubuntu1.2
libsasl2-modules-gssapi-mit:amd64 2.1.27+dfsg2-3ubuntu1.2

SCRAM remains installed, but now belongs to libsasl2-modules:
ubuntu@j-sasl-scram:~$ ll /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
lrwxrwxrwx 1 root root 18 Dec 12 11:52 /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2 -> libscram.so.2.0.25

ubuntu@j-sasl-scram:~$ dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
libsasl2-modules:amd64: /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2

Test (a) succeeded.

[Andreas Hasenack (ahasenack)]

Jammy verification (continued), test (b)

b) On the heels of the (a) test, release upgrade to kinetic
The summary two packages are going to be removed, not related to cyrus-sasl2.

At the end, 13 packages were going to be removed, also not related to cyrus-sasl2:
13 packages are going to be removed.

 Continue [yN] Details [d]d
Remove (was auto installed) binutils binutils-common
  binutils-x86-64-linux-gnu inetutils-telnet libbinutils
  libctf-nobfd0 libctf0 libdns-export1110 libgprofng0 libicu70
  libisc-export1105 python3-openssl telnet

After the release upgrade, we got the kinetic version of the cyrus-sasl2 packages installed as expected:
root@j-sasl-scram:~# dpkg -l | grep -E "^ii.*sasl2" | awk '{print $2,$3}'
libsasl2-2:amd64 2.1.28+dfsg-6ubuntu2
libsasl2-modules:amd64 2.1.28+dfsg-6ubuntu2
libsasl2-modules-db:amd64 2.1.28+dfsg-6ubuntu2
libsasl2-modules-gssapi-mit:amd64 2.1.28+dfsg-6ubuntu2
root@j-sasl-scram:~# apt-cache policy libsasl2-modules
libsasl2-modules:
  Installed: 2.1.28+dfsg-6ubuntu2
  Candidate: 2.1.28+dfsg-6ubuntu2
  Version table:
 *** 2.1.28+dfsg-6ubuntu2 500
        500 http://br.archive.ubuntu.com/ubuntu kinetic/main amd64 Packages
        100 /var/lib/dpkg/status

And SCRAM is part of libsasl2-modules as expected:
root@j-sasl-scram:~# ll /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
lrwxrwxrwx 1 root root 18 Aug 16 2022 /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2 -> libscram.so.2.0.25
root@j-sasl-scram:~# dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
libsasl2-modules:amd64: /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2

Test (b) succeeded.

[Andreas Hasenack (ahasenack)]

Jammy verification (continued), test (c)

c) A jammy system WITHOUT the SCRAM mechanism available (i.e., libsasl2-modules-gssapi-mit is NOT installed), will get SCRAM available after the upgrade, but without installing any new package.

Starting on jammy with these installed:
$ dpkg -l | grep -E "^ii.*sasl2" | awk '{print $2,$3}'
libsasl2-2:amd64 2.1.27+dfsg2-3ubuntu1.1
libsasl2-modules:amd64 2.1.27+dfsg2-3ubuntu1.1
libsasl2-modules-db:amd64 2.1.27+dfsg2-3ubuntu1.1

SCRAM is not available:
$ ll /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
ls: cannot access '/usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2': No such file or directory

Enabling proposed and installing the same packages from proposed:
$ sudo apt install libsasl2-2 libsasl2-modules libsasl2-modules-db
(...)
$ dpkg -l | grep -E "^ii.*sasl2" | awk '{print $2,$3}'
libsasl2-2:amd64 2.1.27+dfsg2-3ubuntu1.2
libsasl2-modules:amd64 2.1.27+dfsg2-3ubuntu1.2
libsasl2-modules-db:amd64 2.1.27+dfsg2-3ubuntu1.2

Same packages are installed, just a new updated version, and now we have SCRAM available:
$ ll /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
lrwxrwxrwx 1 root root 18 Dec 12 11:52 /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2 -> libscram.so.2.0.25

$ dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
libsasl2-modules:amd64: /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2

Performing a release upgrade to kinetic:

- in the summary, two unrelated packages are going to be removed
- in the end, 13 unrelated packages were removed:
13 packages are going to be removed.

 Continue [yN] Details [d]d
Remove (was auto installed) binutils binutils-common
  binutils-x86-64-linux-gnu inetutils-telnet libbinutils
  libctf-nobfd0 libctf0 libdns-export1110 libgprofng0 libicu70
  libisc-export1105 python3-openssl telnet

No new sasl2 package were installed, they just were updated to the kinetic version:
$ dpkg -l | grep -E "^ii.*sasl2" | awk '{print $2,$3}'
libsasl2-2:amd64 2.1.28+dfsg-6ubuntu2
libsasl2-modules:amd64 2.1.28+dfsg-6ubuntu2
libsasl2-modules-db:amd64 2.1.28+dfsg-6ubuntu2
$ apt-cache policy libsasl2-modules
libsasl2-modules:
  Installed: 2.1.28+dfsg-6ubuntu2
  Candidate: 2.1.28+dfsg-6ubuntu2
  Version table:
 *** 2.1.28+dfsg-6ubuntu2 500
        500 http://br.archive.ubuntu.com/ubuntu kinetic/main amd64 Packages
        100 /var/lib/dpkg/status

And SCRAM remains available and part of libsasl2-modules:
$ ll /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
lrwxrwxrwx 1 root root 18 Aug 16 2022 /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2 -> libscram.so.2.0.25

$ dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
libsasl2-modules:amd64: /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2

Test (c) succeeded.

[Andreas Hasenack (ahasenack)]

Jammy verification (continued), test (d)

d) It's now possible to have SCRAM and gssapi heimdal mechanisms installed at the same time

Start with SCRAM available on jammy, by installing the gssapi-mit package:

$ sudo apt install libsasl2-modules-gssapi-mit
...
$ ll /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
lrwxrwxrwx 1 root root 18 Oct 19 21:06 /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2 -> libscram.so.2.0.25

$ dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
libsasl2-modules-gssapi-mit:amd64: /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2

Confirming that installing libsasl2-modules-gssapi-heimdal from jammy removes libsasl2-modules-gssapi-mit:

$ sudo apt install libsasl2-modules-gssapi-heimdal
(...)
The following packages will be REMOVED:
  libsasl2-modules-gssapi-mit

And that removes the SCRAM module with it.

Switching to jammy-proposed, however, while still removing libsasl2-modules-gssapi-mit, will NOT remove the SCRAM module:

$ dpkg -l | grep -E "^ii.*sasl2" | awk '{print $2,$3}'
libsasl2-2:amd64 2.1.27+dfsg2-3ubuntu1.1
libsasl2-modules:amd64 2.1.27+dfsg2-3ubuntu1.2
libsasl2-modules-db:amd64 2.1.27+dfsg2-3ubuntu1.1
libsasl2-modules-gssapi-heimdal:amd64 2.1.27+dfsg2-3ubuntu1.2

$ apt-cache policy libsasl2-modules
libsasl2-modules:
  Installed: 2.1.27+dfsg2-3ubuntu1.2
  Candidate: 2.1.27+dfsg2-3ubuntu1.2
  Version table:
 *** 2.1.27+dfsg2-3ubuntu1.2 500
        500 http://br.archive.ubuntu.com/ubuntu jammy-proposed/main amd64 Packages
        100 /var/lib/dpkg/status
     2.1.27+dfsg2-3ubuntu1.1 500
        500 http://br.archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
     2.1.27+dfsg2-3ubuntu1 500
        500 http://br.archive.ubuntu.com/ubuntu jammy/main amd64 Packages

And even though we no longer have libsasl2-modules-gssapi-mit (due to the expected conflict with -heimdal), the SCRAM module is available:

$ ll /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
lrwxrwxrwx 1 root root 18 Dec 12 11:52 /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2 -> libscram.so.2.0.25

$ dpkg -S /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2
libsasl2-modules:amd64: /usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2

Now performing a release upgrade to kinetic with the system in the above state:
- like before, the summary presents that two (unrelated to cyrus-sasl2) packages will be removed
- in the end, 13 unrelated packages were removed:
13 packages are going to be removed.

 Continue [yN] Details [d]d
Remove (was auto installed) binutils binutils-common
  binutils-x86-64-linux-gnu inetutils-telnet libbinutils
  libctf-nobfd0 libctf0 libdns-export1110 libgprofng0 libicu70
  libisc-export1105 python3-openssl telnet

After the release upgrade, these were the sasl2 packages installed (from kinetic):
$ dpkg -l | grep sasl2 | awk '{print $2,$3}'
libsasl2-2:amd64 2.1.28+dfsg-6ubuntu2
libsasl2-modules:amd64 2.1.28+dfsg-6ubuntu2
libsasl2-modules-db:amd64 2.1.28+dfsg-6ubuntu2
libsasl2-modules-gssapi-heimdal:amd64 2.1.28+dfsg-6ubuntu2

$ apt-cache policy libsasl2-modules
libsasl2-modules:
  Installed: 2.1.28+dfsg-6ubuntu2
  Candidate: 2.1.28+dfsg-6ubuntu2
  Version table:
 *** 2.1.28+dfsg-6ubuntu2 500
        500 http://br.archive.ubuntu...

[Andreas Hasenack (ahasenack)]

All tests succeeded, marking verification done.

[Chris Halse Rogers (raof)]

The verification of the Stable Release Update for cyrus-sasl2 has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package cyrus-sasl2 - 2.1.27+dfsg2-3ubuntu1.2

---------------
cyrus-sasl2 (2.1.27+dfsg2-3ubuntu1.2) jammy; urgency=medium

  * d/control, d/libsasl2-modules-gssapi-mit.install,
    d/libsasl2-modules.install: move the SCRAM mechanism to
    the libsasl2-modules package (LP: #1988730)

 -- Andreas Hasenack <email address hidden> Mon, 12 Dec 2022 08:52:45 -0300