[SECURITY] [DLA 3052-1] cyrus-imapd security update

2022-06-1922:39:52

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.004 Low

EPSS

Percentile

74.8%

JSON

Debian LTS Advisory DLA-3052-1 [email protected]
https://www.debian.org/lts/security/ Markus Koschany
June 20, 2022 https://wiki.debian.org/LTS

Package : cyrus-imapd
Version : 2.5.10-3+deb9u3
CVE ID : CVE-2019-18928 CVE-2021-33582
Debian Bug : 993433

It was discovered that the Cyrus IMAP server was prone to a denial of service
attack via input that is mishandled during hash-table interaction. Furthermore
it allowed privilege escalation because an HTTP request may be interpreted in
the authentication context of an unrelated previous request that arrived over
the same connection.

For Debian 9 stretch, these problems have been fixed in version
2.5.10-3+deb9u3.

We recommend that you upgrade your cyrus-imapd packages.

For the detailed security status of cyrus-imapd please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/cyrus-imapd

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part

OSVersionArchitecturePackageVersionFilename
Debian10i386cyrus-imapd-dbgsym< 3.0.8-6+deb10u6cyrus-imapd-dbgsym_3.0.8-6+deb10u6_i386.deb
Debian10mips64elcyrus-pop3d-dbgsym< 3.0.8-6+deb10u6cyrus-pop3d-dbgsym_3.0.8-6+deb10u6_mips64el.deb
Debian10arm64libcyrus-imap-perl< 3.0.8-6+deb10u6libcyrus-imap-perl_3.0.8-6+deb10u6_arm64.deb
Debian11ppc64elcyrus-imapd-dbgsym< 3.2.6-2+deb11u1cyrus-imapd-dbgsym_3.2.6-2+deb11u1_ppc64el.deb
Debian11amd64libcyrus-imap-perl-dbgsym< 3.2.6-2+deb11u1libcyrus-imap-perl-dbgsym_3.2.6-2+deb11u1_amd64.deb
Debian10ppc64elcyrus-murder-dbgsym< 3.0.8-6+deb10u6cyrus-murder-dbgsym_3.0.8-6+deb10u6_ppc64el.deb
Debian11ppc64elcyrus-common< 3.2.6-2+deb11u1cyrus-common_3.2.6-2+deb11u1_ppc64el.deb
Debian10arm64libcyrus-imap-perl-dbgsym< 3.0.8-6+deb10u6libcyrus-imap-perl-dbgsym_3.0.8-6+deb10u6_arm64.deb
Debian10i386cyrus-murder-dbgsym< 3.0.8-6+deb10u6cyrus-murder-dbgsym_3.0.8-6+deb10u6_i386.deb
Debian10mips64elcyrus-murder< 3.0.8-6+deb10u6cyrus-murder_3.0.8-6+deb10u6_mips64el.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	i386	cyrus-imapd-dbgsym	< 3.0.8-6+deb10u6	cyrus-imapd-dbgsym_3.0.8-6+deb10u6_i386.deb
Debian	10	mips64el	cyrus-pop3d-dbgsym	< 3.0.8-6+deb10u6	cyrus-pop3d-dbgsym_3.0.8-6+deb10u6_mips64el.deb
Debian	10	arm64	libcyrus-imap-perl	< 3.0.8-6+deb10u6	libcyrus-imap-perl_3.0.8-6+deb10u6_arm64.deb
Debian	11	ppc64el	cyrus-imapd-dbgsym	< 3.2.6-2+deb11u1	cyrus-imapd-dbgsym_3.2.6-2+deb11u1_ppc64el.deb
Debian	11	amd64	libcyrus-imap-perl-dbgsym	< 3.2.6-2+deb11u1	libcyrus-imap-perl-dbgsym_3.2.6-2+deb11u1_amd64.deb
Debian	10	ppc64el	cyrus-murder-dbgsym	< 3.0.8-6+deb10u6	cyrus-murder-dbgsym_3.0.8-6+deb10u6_ppc64el.deb
Debian	11	ppc64el	cyrus-common	< 3.2.6-2+deb11u1	cyrus-common_3.2.6-2+deb11u1_ppc64el.deb
Debian	10	arm64	libcyrus-imap-perl-dbgsym	< 3.0.8-6+deb10u6	libcyrus-imap-perl-dbgsym_3.0.8-6+deb10u6_arm64.deb
Debian	10	i386	cyrus-murder-dbgsym	< 3.0.8-6+deb10u6	cyrus-murder-dbgsym_3.0.8-6+deb10u6_i386.deb
Debian	10	mips64el	cyrus-murder	< 3.0.8-6+deb10u6	cyrus-murder_3.0.8-6+deb10u6_mips64el.deb