CVE-2019-18928
cyrus-imapd: privilege escalation in HTTP request
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (orta), Oracle (orta), Ubuntu (orta).
Açıklama
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 10 | cyrus-imapd | 3.0.8-6+deb10u3 |
| debian 11 | cyrus-imapd | 3.0.12-1 |
| debian 12 | cyrus-imapd | 3.0.12-1 |
| debian 13 | cyrus-imapd | 3.0.12-1 |
| debian 14 | cyrus-imapd | 3.0.12-1 |
| debian 9 | cyrus-imapd | 2.5.10-3+deb9u3 |
| echo | cyrus-imapd | 3.0.12-1 |
| Oracle Linux 8 | cyrus-imapd, cyrus-imapd-utils, cyrus-imapd-vzic | 3.0.7-19.el8 |
| ubuntu 18.04-ESM | cyrus-imapd | 2.5.10-3ubuntu1.1+esm1 |
| ubuntu 20.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.04-ESM | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.10 | cyrus-imapd | 3.0.12-1 |
20 kaynaktaki 22 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 10 | cyrus-imapd | 3.0.8-6+deb10u3 |
| debian 11 | cyrus-imapd | 3.0.12-1 |
| debian 12 | cyrus-imapd | 3.0.12-1 |
| debian 13 | cyrus-imapd | 3.0.12-1 |
| debian 14 | cyrus-imapd | 3.0.12-1 |
| debian 9 | cyrus-imapd | 2.5.10-3+deb9u3 |
| echo | cyrus-imapd | 3.0.12-1 |
| Oracle Linux 8 | cyrus-imapd | 3.0.7-19.el8 |
| Oracle Linux 8 | cyrus-imapd-utils | 3.0.7-19.el8 |
| Oracle Linux 8 | cyrus-imapd-vzic | 3.0.7-19.el8 |
| ubuntu 18.04-ESM | cyrus-imapd | 2.5.10-3ubuntu1.1+esm1 |
| ubuntu 20.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.04-ESM | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 21.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 21.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 22.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 22.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 23.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 23.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 24.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 24.10 | cyrus-imapd | 3.0.12-1 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2019-18928
- https://github.com/cyrusimap/cyrus-imapd/issues/2904
- https://linux.oracle.com/cve/CVE-2019-18928.html
- https://linux.oracle.com/errata/ELSA-2020-4655.html
- https://lists.debian.org/debian-lts-announce/2022/06/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAGKPZDXQ6KRUGQVRAO6N4PCINP6KS5F/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHV3TUU53WCKJ3BBRK2EHAF44MSZEFK6/
- https://nvd.nist.gov/vuln/detail/CVE-2019-18928