CVE-2019-18928
cyrus-imapd: privilege escalation in HTTP request
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (media), Oracle (media), Ubuntu (media).
Descripción
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 10 | cyrus-imapd | 3.0.8-6+deb10u3 |
| debian 11 | cyrus-imapd | 3.0.12-1 |
| debian 12 | cyrus-imapd | 3.0.12-1 |
| debian 13 | cyrus-imapd | 3.0.12-1 |
| debian 14 | cyrus-imapd | 3.0.12-1 |
| debian 9 | cyrus-imapd | 2.5.10-3+deb9u3 |
| echo | cyrus-imapd | 3.0.12-1 |
| Oracle Linux 8 | cyrus-imapd, cyrus-imapd-utils, cyrus-imapd-vzic | 3.0.7-19.el8 |
| ubuntu 18.04-ESM | cyrus-imapd | 2.5.10-3ubuntu1.1+esm1 |
| ubuntu 20.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.04-ESM | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.10 | cyrus-imapd | 3.0.12-1 |
Mostrar las 22 entradas de 20 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 10 | cyrus-imapd | 3.0.8-6+deb10u3 |
| debian 11 | cyrus-imapd | 3.0.12-1 |
| debian 12 | cyrus-imapd | 3.0.12-1 |
| debian 13 | cyrus-imapd | 3.0.12-1 |
| debian 14 | cyrus-imapd | 3.0.12-1 |
| debian 9 | cyrus-imapd | 2.5.10-3+deb9u3 |
| echo | cyrus-imapd | 3.0.12-1 |
| Oracle Linux 8 | cyrus-imapd | 3.0.7-19.el8 |
| Oracle Linux 8 | cyrus-imapd-utils | 3.0.7-19.el8 |
| Oracle Linux 8 | cyrus-imapd-vzic | 3.0.7-19.el8 |
| ubuntu 18.04-ESM | cyrus-imapd | 2.5.10-3ubuntu1.1+esm1 |
| ubuntu 20.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.04-ESM | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 21.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 21.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 22.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 22.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 23.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 23.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 24.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 24.10 | cyrus-imapd | 3.0.12-1 |
Referencias
- https://access.redhat.com/security/cve/CVE-2019-18928
- https://github.com/cyrusimap/cyrus-imapd/issues/2904
- https://linux.oracle.com/cve/CVE-2019-18928.html
- https://linux.oracle.com/errata/ELSA-2020-4655.html
- https://lists.debian.org/debian-lts-announce/2022/06/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAGKPZDXQ6KRUGQVRAO6N4PCINP6KS5F/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHV3TUU53WCKJ3BBRK2EHAF44MSZEFK6/
- https://nvd.nist.gov/vuln/detail/CVE-2019-18928