USN-7224-1: Cyrus IMAP Server vulnerabilities

USN-7224-1: Cyrus IMAP Server vulnerabilities
22 January 2025

Several security issues were fixed in Cyrus IMAP Server.

Releases

• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages
cyrus-imapd - An IMAP server

Details
It was discovered that non-authentication-related HTTP requests could be
interpreted in an authentication context by a Cyrus IMAP Server when
multiple requests arrived over the same connection. An unauthenticated
attacker could possibly use this issue to perform a privilege escalation
attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-18928)

Matthew Horsfall discovered that Cyrus IMAP Server utilized a poor string
hashing algorithm that could be abused to control where data was being
stored. An attacker could possibly use this issue to perform a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2021-33582)

Damian Poddebniak discovered that Cyrus IMAP Server could interpret
specially crafted commands to exploit a memory issue. An authenticated
attacker could possibly use this issue to perform a denial of service.
This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2024-34055)

Update instructions
The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.04

• cyrus-admin - 3.8.2-1ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-caldav - 3.8.2-1ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-clients - 3.8.2-1ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-common - 3.8.2-1ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-dev - 3.8.2-1ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-imapd - 3.8.2-1ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-murder - 3.8.2-1ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-nntpd - 3.8.2-1ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-pop3d - 3.8.2-1ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-replication - 3.8.2-1ubuntu0.1~esm1
• Available with Ubuntu Pro
• libcyrus-imap-perl - 3.8.2-1ubuntu0.1~esm1
• Available with Ubuntu Pro

Ubuntu 22.04

• cyrus-admin - 3.4.3-3ubuntu0.1+esm1
• Available with Ubuntu Pro
• cyrus-caldav - 3.4.3-3ubuntu0.1+esm1
• Available with Ubuntu Pro
• cyrus-clients - 3.4.3-3ubuntu0.1+esm1
• Available with Ubuntu Pro
• cyrus-common - 3.4.3-3ubuntu0.1+esm1
• Available with Ubuntu Pro
• cyrus-dev - 3.4.3-3ubuntu0.1+esm1
• Available with Ubuntu Pro
• cyrus-imapd - 3.4.3-3ubuntu0.1+esm1
• Available with Ubuntu Pro
• cyrus-murder - 3.4.3-3ubuntu0.1+esm1
• Available with Ubuntu Pro
• cyrus-nntpd - 3.4.3-3ubuntu0.1+esm1
• Available with Ubuntu Pro
• cyrus-pop3d - 3.4.3-3ubuntu0.1+esm1
• Available with Ubuntu Pro
• cyrus-replication - 3.4.3-3ubuntu0.1+esm1
• Available with Ubuntu Pro
• libcyrus-imap-perl - 3.4.3-3ubuntu0.1+esm1
• Available with Ubuntu Pro

Ubuntu 20.04

• cyrus-caldav - 3.0.13-5ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-clients - 3.0.13-5ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-common - 3.0.13-5ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-dev - 3.0.13-5ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-imapd - 3.0.13-5ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-murder - 3.0.13-5ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-nntpd - 3.0.13-5ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-pop3d - 3.0.13-5ubuntu0.1~esm1
• Available with Ubuntu Pro
• cyrus-replication - 3.0.13-5ubuntu0.1~esm1
• Available with Ubuntu Pro
• libcyrus-imap-perl - 3.0.13-5ubuntu0.1~esm1
• Available with Ubuntu Pro

Ubuntu 18.04

• cyrus-caldav - 2.5.10-3ubuntu1.1+esm1
• Available with Ubuntu Pro
• cyrus-clients - 2.5.10-3ubuntu1.1+esm1
• Available with Ubuntu Pro
• cyrus-common - 2.5.10-3ubuntu1.1+esm1
• Available with Ubuntu Pro
• cyrus-dev - 2.5.10-3ubuntu1.1+esm1
• Available with Ubuntu Pro
• cyrus-imapd - 2.5.10-3ubuntu1.1+esm1
• Available with Ubuntu Pro
• cyrus-murder - 2.5.10-3ubuntu1.1+esm1
• Available with Ubuntu Pro
• cyrus-nntpd - 2.5.10-3ubuntu1.1+esm1
• Available with Ubuntu Pro
• cyrus-pop3d - 2.5.10-3ubuntu1.1+esm1
• Available with Ubuntu Pro
• cyrus-replication - 2.5.10-3ubuntu1.1+esm1
• Available with Ubuntu Pro
• libcyrus-imap-perl - 2.5.10-3ubuntu1.1+esm1
• Available with Ubuntu Pro