Bug 1993232 (CVE-2021-33582)
| Summary: | CVE-2021-33582 cyrus-imapd: Denial of service via string hashing algorithm collisions | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | jorton, j, mhlavink, nobody, ovasik, pavel, security-response-team, tkorbar, vanmeeuwen+fedora, zdohnal |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | cyrus-imapd 3.0.16, cyrus-imapd 3.2.8, cyrus-imapd 3.4.2 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in cyrus-imapd. A bad string hashing algorithm used in internal hash tables allows user inputs to be stored in predictable buckets. A user may cause a CPU denial of service by maliciously directing many inputs to a single bucket. The highest threat from this vulnerability is to system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-09-13 12:21:10 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1994029, 1994030, 1994032, 1994033, 1994034, 2000080, 2002979 | ||
| Bug Blocks: | 1993234 | ||
|
Description
Pedro Sampaio
2021-08-12 15:15:23 UTC
Created cyrus-imapd tracking bugs for this issue: Affects: fedora-all [bug 2000080] References: https://cyrus.topicbox.com/groups/announce/T3dde0a2352462975-M1386fc44adf967e072f8df13/cyrus-imap-3-4-2-3-2-8-and-3-0-16-released https://www.cyrusimap.org/imap/download/release-notes/3.4/x/3.4.2.html https://www.cyrusimap.org/imap/download/release-notes/3.2/x/3.2.8.html https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.16.html This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2021:3493 https://access.redhat.com/errata/RHSA-2021:3493 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:3492 https://access.redhat.com/errata/RHSA-2021:3492 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-33582 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2021:3546 https://access.redhat.com/errata/RHSA-2021:3546 |