Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cyrus-imapd-vzicUpgrade cyrus-imapd-utilsUpgrade cyrus-imapd | May 4, 2022 | Sep 1, 2021 |
| Amazon Linux Ami 2 | — | Upgrade cyrus-imapdUpgrade cyrus-imapd-debuginfoUpgrade cyrus-imapd-utilsUpgrade cyrus-imapd-devel | Jul 4, 2022 | Sep 1, 2021 |
| Amazon_linux | — | Upgrade cyrus-imapd | Jan 20, 2022 | Sep 1, 2021 |
| Centos_linux | — | Upgrade cyrus-imapd-debugsourceUpgrade cyrus-imapd-debuginfoUpgrade cyrus-imapd-vzicUpgrade cyrus-imapd-vzic-debuginfoUpgrade cyrus-imapd-utilsUpgrade cyrus-imapd-utils-debuginfoUpgrade cyrus-imapd | Sep 14, 2021 | Sep 1, 2021 |
| Debian | — | Upgrade cyrus-imapd | Jun 21, 2022 | Sep 1, 2021 |
| Freebsd | — | Upgrade cyrus-imapd25Upgrade cyrus-imapd32Upgrade cyrus-imapd30Upgrade cyrus-imapd34Upgrade cyrus-imapd24Upgrade cyrus-imapd23 | Nov 4, 2022 | Sep 1, 2021 |
| Oracle_linux | — | Upgrade cyrus-imapd-vzicUpgrade cyrus-imapd-utilsUpgrade cyrus-imapd | Sep 14, 2021 | Sep 1, 2021 |
| Redhat_linux | — | Upgrade cyrus-imapd-debuginfoUpgrade cyrus-imapd-utilsUpgrade cyrus-imapd-utils-debuginfoNo solution existsUpgrade cyrus-imapdUpgrade cyrus-imapd-vzic-debuginfoUpgrade cyrus-imapd-debugsourceUpgrade cyrus-imapd-vzic | Sep 14, 2021 | Sep 1, 2021 |
| Rocky_linux | — | Upgrade cyrus-imapd-utils-debuginfoUpgrade cyrus-imapd-debugsourceUpgrade cyrus-imapd-utilsUpgrade cyrus-imapd-vzicUpgrade cyrus-imapd-vzic-debuginfoUpgrade cyrus-imapd-debuginfoUpgrade cyrus-imapd | May 5, 2022 | Sep 1, 2021 |
| Ubuntu | — | Upgrade cyrus-replication (Ubuntu Pro)Upgrade cyrus-caldav (Ubuntu Pro)Upgrade cyrus-dev (Ubuntu Pro)Upgrade cyrus-imapd (Ubuntu Pro)Upgrade cyrus-admin (Ubuntu Pro)Upgrade cyrus-clients (Ubuntu Pro)Upgrade cyrus-murder (Ubuntu Pro)Upgrade cyrus-common (Ubuntu Pro)Upgrade libcyrus-imap-perl (Ubuntu Pro)Upgrade cyrus-pop3d (Ubuntu Pro)Upgrade cyrus-nntpd (Ubuntu Pro) | Jan 24, 2025 | Sep 1, 2021 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub