Vulnerability · Published Jun 5, 2024 · Assigned by mitre
CVE-2024-34055
Medium 6.5
In plain English
A medium-severity resource allocation without limits in the cyrus-imapd package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.8%top 42.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | cyrus-imapd | 3.4.8-1.el9 | ALSA-2024:9195 |
| AlmaLinux:9 | cyrus-imapd-libs | 3.4.8-1.el9 | ALSA-2024:9195 |
| AlmaLinux:9 | cyrus-imapd-utils | 3.4.8-1.el9 | ALSA-2024:9195 |
| AlmaLinux:9 | perl-Cyrus | 3.4.8-1.el9 | ALSA-2024:9195 |
| Debian:12 | cyrus-imapd | 3.6.1-4+deb12u2 | DSA-5708-1 |
| Debian:12 | cyrus-imapd | 3.6.1-4+deb12u2 | DEBIAN-CVE-2024-34055 |
| Debian:13 | cyrus-imapd | 3.8.3-1 | DEBIAN-CVE-2024-34055 |
| Debian:14 | cyrus-imapd | 3.8.3-1 | DEBIAN-CVE-2024-34055 |
| Rocky Linux:9 | cyrus-imapd | 0:3.4.8-1.el9 | RLSA-2024:9195 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/cyrusimap/cyrus-imapd/commit/ef9e4e8314d6a06f2269af0ccf606894cc3fe489
- https://www.cyrusimap.org/imap/download/release-notes/3.8/x/3.8.3.html
- https://www.cyrusimap.org/dev/imap/download/release-notes/3.10/x/3.10.0-rc1.html
- FEDORA-2024-f3e0255c75 vendor-advisory
- FEDORA-2024-123f2b3666 vendor-advisory