CVE-2019-18928
Fixed in a distro release EPSS 2%
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
Products: cyrus imap, fedoraproject fedora, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | cyrus-imapd | 3.0.12-1 |
| Debian 13 | cyrus-imapd | 3.0.12-1 |
| Debian 14 | cyrus-imapd | 3.0.12-1 |
| Debian 9 | cyrus-imapd | 2.5.10-3+deb9u3 |
| Red Hat Enterprise Linux 8 | cyrus-imapd | 0:3.0.7-19.el8 |
| Red Hat Enterprise Linux 8 | cyrus-imapd-debuginfo | 0:3.0.7-19.el8 |
| Red Hat Enterprise Linux 8 | cyrus-imapd-debugsource | 0:3.0.7-19.el8 |
| Red Hat Enterprise Linux 8 | cyrus-imapd-utils | 0:3.0.7-19.el8 |
| Red Hat Enterprise Linux 8 | cyrus-imapd-utils-debuginfo | 0:3.0.7-19.el8 |
| Red Hat Enterprise Linux 8 | cyrus-imapd-vzic | 0:3.0.7-19.el8 |
| Red Hat Enterprise Linux 8 | cyrus-imapd-vzic-debuginfo | 0:3.0.7-19.el8 |
| Ubuntu 20.04 LTS | cyrus-imapd | 3.0.12-1 |
| Ubuntu Pro 18.04 LTS | cyrus-imapd | 2.5.10-3ubuntu1.1+esm1 |
| Ubuntu Pro 20.04 LTS | cyrus-imapd | 3.0.13-5ubuntu0.1~esm1 |
| Ubuntu Pro 22.04 LTS | cyrus-imapd | 3.4.3-3ubuntu0.1+esm1 |
| Ubuntu Pro 24.04 LTS | cyrus-imapd | 3.8.2-1ubuntu0.1~esm1 |
| openSUSE Tumbleweed | cyrus-imapd | 3.8.4-1.1 |