CVE-2019-11356
Fixed in a distro release EPSS 8%
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
Products: cyrus imap, fedoraproject fedora, debian_linux, canonical ubuntu_linux, redhat enterprise_linux, redhat enterprise_linux_eus, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_tus
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | cyrus-imapd | 3.0.8-6 |
| Debian 13 | cyrus-imapd | 3.0.8-6 |
| Debian 14 | cyrus-imapd | 3.0.8-6 |
| Debian 9 | cyrus-imapd | 2.5.10-3+deb9u1 |
| Red Hat Enterprise Linux 8 | cyrus-imapd | 0:3.0.7-15.el8_0.1 |
| Red Hat Enterprise Linux 8 | cyrus-imapd-debuginfo | 0:3.0.7-15.el8_0.1 |
| Red Hat Enterprise Linux 8 | cyrus-imapd-debugsource | 0:3.0.7-15.el8_0.1 |
| Red Hat Enterprise Linux 8 | cyrus-imapd-utils | 0:3.0.7-15.el8_0.1 |
| Red Hat Enterprise Linux 8 | cyrus-imapd-utils-debuginfo | 0:3.0.7-15.el8_0.1 |
| Red Hat Enterprise Linux 8 | cyrus-imapd-vzic | 0:3.0.7-15.el8_0.1 |
| Red Hat Enterprise Linux 8 | cyrus-imapd-vzic-debuginfo | 0:3.0.7-15.el8_0.1 |
| Ubuntu 18.04 LTS | cyrus-imapd | 2.5.10-3ubuntu1.1 |
| openSUSE Tumbleweed | cyrus-imapd | 3.8.4-1.1 |