CVE-2019-18928
cyrus-imapd: privilege escalation in HTTP request
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (moyenne), Oracle (moyenne), Ubuntu (moyenne).
Description
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 10 | cyrus-imapd | 3.0.8-6+deb10u3 |
| debian 11 | cyrus-imapd | 3.0.12-1 |
| debian 12 | cyrus-imapd | 3.0.12-1 |
| debian 13 | cyrus-imapd | 3.0.12-1 |
| debian 14 | cyrus-imapd | 3.0.12-1 |
| debian 9 | cyrus-imapd | 2.5.10-3+deb9u3 |
| echo | cyrus-imapd | 3.0.12-1 |
| Oracle Linux 8 | cyrus-imapd, cyrus-imapd-utils, cyrus-imapd-vzic | 3.0.7-19.el8 |
| ubuntu 18.04-ESM | cyrus-imapd | 2.5.10-3ubuntu1.1+esm1 |
| ubuntu 20.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.04-ESM | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.10 | cyrus-imapd | 3.0.12-1 |
Afficher les 22 entrées de 20 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 10 | cyrus-imapd | 3.0.8-6+deb10u3 |
| debian 11 | cyrus-imapd | 3.0.12-1 |
| debian 12 | cyrus-imapd | 3.0.12-1 |
| debian 13 | cyrus-imapd | 3.0.12-1 |
| debian 14 | cyrus-imapd | 3.0.12-1 |
| debian 9 | cyrus-imapd | 2.5.10-3+deb9u3 |
| echo | cyrus-imapd | 3.0.12-1 |
| Oracle Linux 8 | cyrus-imapd | 3.0.7-19.el8 |
| Oracle Linux 8 | cyrus-imapd-utils | 3.0.7-19.el8 |
| Oracle Linux 8 | cyrus-imapd-vzic | 3.0.7-19.el8 |
| ubuntu 18.04-ESM | cyrus-imapd | 2.5.10-3ubuntu1.1+esm1 |
| ubuntu 20.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.04-ESM | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 21.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 21.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 22.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 22.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 23.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 23.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 24.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 24.10 | cyrus-imapd | 3.0.12-1 |
Références
- https://access.redhat.com/security/cve/CVE-2019-18928
- https://github.com/cyrusimap/cyrus-imapd/issues/2904
- https://linux.oracle.com/cve/CVE-2019-18928.html
- https://linux.oracle.com/errata/ELSA-2020-4655.html
- https://lists.debian.org/debian-lts-announce/2022/06/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAGKPZDXQ6KRUGQVRAO6N4PCINP6KS5F/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHV3TUU53WCKJ3BBRK2EHAF44MSZEFK6/
- https://nvd.nist.gov/vuln/detail/CVE-2019-18928