crítica
CVE-2019-11356
cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.6CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (alta), Oracle (alta), Ubuntu (media).
Descripción
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | cyrus-imapd | 3.0.8-6 |
| debian 12 | cyrus-imapd | 3.0.8-6 |
| debian 13 | cyrus-imapd | 3.0.8-6 |
| debian 14 | cyrus-imapd | 3.0.8-6 |
| debian 9 | cyrus-imapd | 2.5.10-3+deb9u1 |
| echo | cyrus-imapd | 3.0.8-6 |
| Oracle Linux 8 | cyrus-imapd, cyrus-imapd-utils, cyrus-imapd-vzic | 3.0.7-15.el8_0.1 |
| ubuntu 18.04 | cyrus-imapd | 2.5.10-3ubuntu1.1 |
| ubuntu 18.04-ESM | cyrus-imapd | 2.5.10-3ubuntu1.1 |
| ubuntu 19.10 | cyrus-imapd | 3.0.8-6 |
| ubuntu 20.04 | cyrus-imapd | 3.0.8-6 |
| ubuntu 20.04-ESM | cyrus-imapd | 3.0.8-6 |
Mostrar las 15 entradas de 13 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | cyrus-imapd | 3.0.8-6 |
| debian 12 | cyrus-imapd | 3.0.8-6 |
| debian 13 | cyrus-imapd | 3.0.8-6 |
| debian 14 | cyrus-imapd | 3.0.8-6 |
| debian 9 | cyrus-imapd | 2.5.10-3+deb9u1 |
| echo | cyrus-imapd | 3.0.8-6 |
| Oracle Linux 8 | cyrus-imapd | 3.0.7-15.el8_0.1 |
| Oracle Linux 8 | cyrus-imapd-utils | 3.0.7-15.el8_0.1 |
| Oracle Linux 8 | cyrus-imapd-vzic | 3.0.7-15.el8_0.1 |
| ubuntu 18.04 | cyrus-imapd | 2.5.10-3ubuntu1.1 |
| ubuntu 18.04-ESM | cyrus-imapd | 2.5.10-3ubuntu1.1 |
| ubuntu 19.10 | cyrus-imapd | 3.0.8-6 |
| ubuntu 20.04 | cyrus-imapd | 3.0.8-6 |
| ubuntu 20.04-ESM | cyrus-imapd | 3.0.8-6 |
| ubuntu 20.10 | cyrus-imapd | 3.0.8-6 |
Referencias
- https://access.redhat.com/errata/RHSA-2019:1771
- https://access.redhat.com/security/cve/CVE-2019-11356
- https://bugzilla.redhat.com/show_bug.cgi?id=1717828
- https://github.com/cyrusimap/cyrus-imapd/commit/a5779db8163b99463e25e7c476f9cbba438b65f3
- https://linux.oracle.com/cve/CVE-2019-11356.html
- https://linux.oracle.com/errata/ELSA-2019-1771.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IGO43JS7IFDNITHXOOHOP6JHRKRDIYY6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PICSZDC3UGEUZ27VXGGM6OFI67D3KKLZ/
Las 18 referencias
- https://nvd.nist.gov/vuln/detail/CVE-2019-11356
- https://seclists.org/bugtraq/2019/Jun/9
- https://ubuntu.com/security/notices/USN-4566-1
- https://usn.ubuntu.com/4566-1/
- https://www.cve.org/CVERecord?id=CVE-2019-11356
- https://www.cyrusimap.org/imap/download/release-notes/2.5/index.html
- https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.13.html
- https://www.cyrusimap.org/imap/download/release-notes/3.0/index.html
- https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.10.html
- https://www.debian.org/security/2019/dsa-4458