CVE-2021-33582

 

Published at: - 01-09-2021 08:15

Last modified: - 20-01-2023 03:09

Total changes: - 10

Description

Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

 

Verification logic

 

Reference

• https://www.cyrusimap.org/imap/download/release-notes/index.html
• https://github.com/cyrusimap/cyrus-imapd/commits/master
• https://cyrus.topicbox.com/groups/announce/T3dde0a2352462975-M1386fc44adf967e072f8df13/cyrus-imap-3-4-2-3-2-8-and-3-0-16-released
• https://github.com/cyrusimap/cyrus-imapd/security/advisories
• FEDORA-2022-c30b1a8aa3-Mailing List, Third Party Advisory
• FEDORA-2022-d45bcc5447-Mailing List, Third Party Advisory
• [debian-lts-announce] 20220619 [SECURITY] [DLA 3052-1] cyrus-imapd security update-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2021-33582

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures