CVE-2024-34055: Medium severity cyrusimap Cyrus IMAP vulnerability
Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cyrus imapto a version that resolves this vulnerability.Fixed in 3.8.3 - Upgrade
Upgrade
redhat/cyrus imapto a version that resolves this vulnerability.Fixed in 3.10.0 - Upgrade
Upgrade
debian/cyrus-imapdto a version that resolves this vulnerability.Fixed in 3.6.1-4+deb12u2 - Upgrade
Upgrade
debian/cyrus-imapdto a version that resolves this vulnerability.Fixed in 3.8.3-1 - Upgrade
Upgrade
debian/cyrus-imapdto a version that resolves this vulnerability.Fixed in 3.6.1-4+deb12u4Fixed in 3.6.1-4+deb12u5Fixed in 3.10.2-1+deb13u2Fixed in 3.12.4-1 - Upgrade
Upgrade
Cyrus IMAPto a version that resolves this vulnerability.Fixed in 3.8.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34055?
CVE-2024-34055 has a high severity rating due to the potential for unbounded memory allocation leading to denial of service.
How do I fix CVE-2024-34055?
To fix CVE-2024-34055, upgrade to Cyrus IMAP version 3.8.3 or 3.10.0-rc1 or later.
What impact does CVE-2024-34055 have on my system?
CVE-2024-34055 allows authenticated attackers to exploit the vulnerability to exhaust system memory, potentially causing service disruptions.
What versions of Cyrus IMAP are affected by CVE-2024-34055?
CVE-2024-34055 affects Cyrus IMAP versions before 3.8.3 and 3.10.x before 3.10.0-rc1.
Who is vulnerable to CVE-2024-34055?
Authenticated users of Cyrus IMAP versions before 3.8.3 and 3.10.x before 3.10.0-rc1 are vulnerable to CVE-2024-34055.