Vulnerability · Published Sep 1, 2021 · Assigned by mitre
CVE-2021-33582
High 7.5
In plain English
A high-severity security flaw in the cyrus-imapd package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)3.1%top 12.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cyrus-imapd | 3.4.2-1 | DEBIAN-CVE-2021-33582 |
| Debian:13 | cyrus-imapd | 3.4.2-1 | DEBIAN-CVE-2021-33582 |
| Debian:14 | cyrus-imapd | 3.4.2-1 | DEBIAN-CVE-2021-33582 |
| Rocky Linux:8 | cyrus-imapd | 0:3.0.7-20.el8_4.1 | RLSA-2021:3492 |
Affected products (as reported)
References
- https://www.cyrusimap.org/imap/download/release-notes/index.html x_refsource_MISC
- https://github.com/cyrusimap/cyrus-imapd/security/advisories x_refsource_MISC
- https://github.com/cyrusimap/cyrus-imapd/commits/master x_refsource_MISC
- https://cyrus.topicbox.com/groups/announce/T3dde0a2352462975-M1386fc44adf967e072f8df13/cyrus-imap-3-4-2-3-2-8-and-3-0-16-released x_refsource_CONFIRM
- FEDORA-2022-c30b1a8aa3 vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-d45bcc5447 vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20220619 [SECURITY] [DLA 3052-1] cyrus-imapd security update mailing-list, x_refsource_MLIST