CVE-2019-18928
cyrus-imapd: privilege escalation in HTTP request
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium), Oracle (medium), Ubuntu (medium).
Description
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 10 | cyrus-imapd | 3.0.8-6+deb10u3 |
| debian 11 | cyrus-imapd | 3.0.12-1 |
| debian 12 | cyrus-imapd | 3.0.12-1 |
| debian 13 | cyrus-imapd | 3.0.12-1 |
| debian 14 | cyrus-imapd | 3.0.12-1 |
| debian 9 | cyrus-imapd | 2.5.10-3+deb9u3 |
| echo | cyrus-imapd | 3.0.12-1 |
| Oracle Linux 8 | cyrus-imapd, cyrus-imapd-utils, cyrus-imapd-vzic | 3.0.7-19.el8 |
| ubuntu 18.04-ESM | cyrus-imapd | 2.5.10-3ubuntu1.1+esm1 |
| ubuntu 20.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.04-ESM | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.10 | cyrus-imapd | 3.0.12-1 |
Show all 22 entries from 20 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 10 | cyrus-imapd | 3.0.8-6+deb10u3 |
| debian 11 | cyrus-imapd | 3.0.12-1 |
| debian 12 | cyrus-imapd | 3.0.12-1 |
| debian 13 | cyrus-imapd | 3.0.12-1 |
| debian 14 | cyrus-imapd | 3.0.12-1 |
| debian 9 | cyrus-imapd | 2.5.10-3+deb9u3 |
| echo | cyrus-imapd | 3.0.12-1 |
| Oracle Linux 8 | cyrus-imapd | 3.0.7-19.el8 |
| Oracle Linux 8 | cyrus-imapd-utils | 3.0.7-19.el8 |
| Oracle Linux 8 | cyrus-imapd-vzic | 3.0.7-19.el8 |
| ubuntu 18.04-ESM | cyrus-imapd | 2.5.10-3ubuntu1.1+esm1 |
| ubuntu 20.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.04-ESM | cyrus-imapd | 3.0.12-1 |
| ubuntu 20.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 21.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 21.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 22.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 22.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 23.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 23.10 | cyrus-imapd | 3.0.12-1 |
| ubuntu 24.04 | cyrus-imapd | 3.0.12-1 |
| ubuntu 24.10 | cyrus-imapd | 3.0.12-1 |
References
- https://access.redhat.com/security/cve/CVE-2019-18928
- https://github.com/cyrusimap/cyrus-imapd/issues/2904
- https://linux.oracle.com/cve/CVE-2019-18928.html
- https://linux.oracle.com/errata/ELSA-2020-4655.html
- https://lists.debian.org/debian-lts-announce/2022/06/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAGKPZDXQ6KRUGQVRAO6N4PCINP6KS5F/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHV3TUU53WCKJ3BBRK2EHAF44MSZEFK6/
- https://nvd.nist.gov/vuln/detail/CVE-2019-18928