CVE-2019-18928
cyrus-imapd: privilege escalation in HTTP request
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (mittel), Oracle (mittel), Ubuntu (mittel).
Beschreibung
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 10 | cyrus-imapd | 3.0.8-6+deb10u3 |
| debian 11 | cyrus-imapd | 3.0.12-1 |
| debian 12 | cyrus-imapd | 3.0.12-1 |
| debian 13 | cyrus-imapd | 3.0.12-1 |
| debian 14 | cyrus-imapd | 3.0.12-1 |
| debian 9 | cyrus-imapd | 2.5.10-3+deb9u3 |
| echo | cyrus-imapd | 3.0.12-1 |
| Oracle Linux 8 | cyrus-imapd, cyrus-imapd-utils, cyrus-imapd-vzic | 3.0.7-19.el8 |
| ubuntu 18.04-ESM | cyrus-imapd | 2.5.10-3ubuntu1.1+esm1 |
| ubuntu 20.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.04-ESM | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.10 | cyrus-imapd | 3.0.12-1 |
Alle 22 Einträge aus 20 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 10 | cyrus-imapd | 3.0.8-6+deb10u3 |
| debian 11 | cyrus-imapd | 3.0.12-1 |
| debian 12 | cyrus-imapd | 3.0.12-1 |
| debian 13 | cyrus-imapd | 3.0.12-1 |
| debian 14 | cyrus-imapd | 3.0.12-1 |
| debian 9 | cyrus-imapd | 2.5.10-3+deb9u3 |
| echo | cyrus-imapd | 3.0.12-1 |
| Oracle Linux 8 | cyrus-imapd | 3.0.7-19.el8 |
| Oracle Linux 8 | cyrus-imapd-utils | 3.0.7-19.el8 |
| Oracle Linux 8 | cyrus-imapd-vzic | 3.0.7-19.el8 |
| ubuntu 18.04-ESM | cyrus-imapd | 2.5.10-3ubuntu1.1+esm1 |
| ubuntu 20.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.04-ESM | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 21.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 21.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 22.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 22.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 23.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 23.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 24.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 24.10 | cyrus-imapd | 3.0.12-1 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2019-18928
- https://github.com/cyrusimap/cyrus-imapd/issues/2904
- https://linux.oracle.com/cve/CVE-2019-18928.html
- https://linux.oracle.com/errata/ELSA-2020-4655.html
- https://lists.debian.org/debian-lts-announce/2022/06/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAGKPZDXQ6KRUGQVRAO6N4PCINP6KS5F/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHV3TUU53WCKJ3BBRK2EHAF44MSZEFK6/
- https://nvd.nist.gov/vuln/detail/CVE-2019-18928