Vulnerability CVE-2021-33582: Information
Description
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.
Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| cyrus-imapd | sisyphus | 3.2.8-alt1 | 3.4.6-alt2 | ALT-PU-2021-2724-1 | 284607 | Fixed |
| cyrus-imapd | p10 | 3.2.8-alt1 | 3.4.6-alt2 | ALT-PU-2021-2731-1 | 284608 | Fixed |
| cyrus-imapd | p9 | 3.2.8-alt1 | 3.2.8-alt1 | ALT-PU-2021-2758-1 | 284606 | Fixed |
| cyrus-imapd | p8 | 2.5.17-alt0.M80P.2 | 2.5.17-alt0.M80P.2 | ALT-PU-2021-2790-1 | 284610 | Fixed |
| cyrus-imapd | c10f1 | 3.2.8-alt1 | 3.2.8-alt1 | ALT-PU-2021-2731-1 | 284608 | Fixed |
| cyrus-imapd | p11 | 3.2.8-alt1 | 3.4.6-alt2 | ALT-PU-2021-2724-1 | 284607 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| https://www.cyrusimap.org/imap/download/release-notes/index.html |
|
| https://github.com/cyrusimap/cyrus-imapd/commits/master |
|
| https://cyrus.topicbox.com/groups/announce/T3dde0a2352462975-M1386fc44adf967e072f8df13/cyrus-imap-3-4-2-3-2-8-and-3-0-16-released |
|
| https://github.com/cyrusimap/cyrus-imapd/security/advisories |
|
| [debian-lts-announce] 20220619 [SECURITY] [DLA 3052-1] cyrus-imapd security update |
|
| FEDORA-2022-c30b1a8aa3 | |
| FEDORA-2022-d45bcc5447 |