Описание
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.
A flaw was found in cyrus-imapd. A bad string hashing algorithm used in internal hash tables allows user inputs to be stored in predictable buckets. A user may cause a CPU denial of service by maliciously directing many inputs to a single bucket. The highest threat from this vulnerability is to system availability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | cyrus-imapd | Out of support scope | ||
| Red Hat Enterprise Linux 7 | cyrus-imapd | Out of support scope | ||
| Red Hat Enterprise Linux 9 | cyrus-imapd | Not affected | ||
| Red Hat Enterprise Linux 8 | cyrus-imapd | Fixed | RHSA-2021:3492 | 13.09.2021 |
| Red Hat Enterprise Linux 8.1 Extended Update Support | cyrus-imapd | Fixed | RHSA-2021:3546 | 15.09.2021 |
| Red Hat Enterprise Linux 8.2 Extended Update Support | cyrus-imapd | Fixed | RHSA-2021:3493 | 13.09.2021 |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of s ...
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.
7.5 High
CVSS3