cyrus-imapd -- Remote authenticated users could bypass intended access restrictions on certain server annotations.

2021-05-0500:00:00

vuxml.freebsd.org

remote authenticated users

access restrictions

server annotations

replication bug

cve-2021-32056

unix

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS

0.001

Percentile

44.9%

JSON

Cyrus IMAP 3.4.1 Release Notes states:

Fixed CVE-2021-32056: Remote authenticated users could bypass intended access restrictions on certain server annotations. Additionally, a long-standing bug in replication did not allow server annotations to be replicated. Combining these two bugs, a remote authenticated user could stall replication, requiring administrator intervention.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchcyrus-imapd34= 3.4.0UNKNOWN
FreeBSDanynoarchcyrus-imapd34< 3.4.1UNKNOWN
FreeBSDanynoarchcyrus-imapd32= 3.2.0UNKNOWN
FreeBSDanynoarchcyrus-imapd32< 3.2.7UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	cyrus-imapd34	= 3.4.0	UNKNOWN
FreeBSD	any	noarch	cyrus-imapd34	< 3.4.1	UNKNOWN
FreeBSD	any	noarch	cyrus-imapd32	= 3.2.0	UNKNOWN
FreeBSD	any	noarch	cyrus-imapd32	< 3.2.7	UNKNOWN