USN-7224-1: Cyrus IMAP Server vulnerabilities

Published Jan 22, 2025
·
Updated

It was discovered that non-authentication-related HTTP requests could be interpreted in an authentication context by a Cyrus IMAP Server when multiple requests arrived over the same connection. An unauthenticated attacker could possibly use this issue to perform a privilege escalation attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-18928) Matthew Horsfall discovered that Cyrus IMAP Server utilized a poor string hashing algorithm that could be abused to control where data was being stored. An attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-33582) Damian Poddebniak discovered that Cyrus IMAP Server could interpret specially crafted commands to exploit a memory issue. An authenticated attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-34055)

Affected Software

84 affected componentsFixes available
All of the following
ubuntu/cyrus-admin<3.8.2-1ubuntu0.1~esm1
3.8.2-1ubuntu0.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/cyrus-caldav<3.8.2-1ubuntu0.1~esm1
3.8.2-1ubuntu0.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/cyrus-clients<3.8.2-1ubuntu0.1~esm1
3.8.2-1ubuntu0.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/cyrus-common<3.8.2-1ubuntu0.1~esm1
3.8.2-1ubuntu0.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/cyrus-dev<3.8.2-1ubuntu0.1~esm1
3.8.2-1ubuntu0.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/cyrus-imapd<3.8.2-1ubuntu0.1~esm1
3.8.2-1ubuntu0.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/cyrus-murder<3.8.2-1ubuntu0.1~esm1
3.8.2-1ubuntu0.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/cyrus-nntpd<3.8.2-1ubuntu0.1~esm1
3.8.2-1ubuntu0.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/cyrus-pop3d<3.8.2-1ubuntu0.1~esm1
3.8.2-1ubuntu0.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/cyrus-replication<3.8.2-1ubuntu0.1~esm1
3.8.2-1ubuntu0.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libcyrus-imap-perl<3.8.2-1ubuntu0.1~esm1
3.8.2-1ubuntu0.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/cyrus-admin<3.4.3-3ubuntu0.1+esm1
3.4.3-3ubuntu0.1+esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/cyrus-caldav<3.4.3-3ubuntu0.1+esm1
3.4.3-3ubuntu0.1+esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/cyrus-clients<3.4.3-3ubuntu0.1+esm1
3.4.3-3ubuntu0.1+esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/cyrus-common<3.4.3-3ubuntu0.1+esm1
3.4.3-3ubuntu0.1+esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/cyrus-dev<3.4.3-3ubuntu0.1+esm1
3.4.3-3ubuntu0.1+esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/cyrus-imapd<3.4.3-3ubuntu0.1+esm1
3.4.3-3ubuntu0.1+esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/cyrus-murder<3.4.3-3ubuntu0.1+esm1
3.4.3-3ubuntu0.1+esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/cyrus-nntpd<3.4.3-3ubuntu0.1+esm1
3.4.3-3ubuntu0.1+esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/cyrus-pop3d<3.4.3-3ubuntu0.1+esm1
3.4.3-3ubuntu0.1+esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/cyrus-replication<3.4.3-3ubuntu0.1+esm1
3.4.3-3ubuntu0.1+esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libcyrus-imap-perl<3.4.3-3ubuntu0.1+esm1
3.4.3-3ubuntu0.1+esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/cyrus-caldav<3.0.13-5ubuntu0.1~esm1
3.0.13-5ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/cyrus-clients<3.0.13-5ubuntu0.1~esm1
3.0.13-5ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/cyrus-common<3.0.13-5ubuntu0.1~esm1
3.0.13-5ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/cyrus-dev<3.0.13-5ubuntu0.1~esm1
3.0.13-5ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/cyrus-imapd<3.0.13-5ubuntu0.1~esm1
3.0.13-5ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/cyrus-murder<3.0.13-5ubuntu0.1~esm1
3.0.13-5ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/cyrus-nntpd<3.0.13-5ubuntu0.1~esm1
3.0.13-5ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/cyrus-pop3d<3.0.13-5ubuntu0.1~esm1
3.0.13-5ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/cyrus-replication<3.0.13-5ubuntu0.1~esm1
3.0.13-5ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libcyrus-imap-perl<3.0.13-5ubuntu0.1~esm1
3.0.13-5ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/cyrus-caldav<2.5.10-3ubuntu1.1+esm1
2.5.10-3ubuntu1.1+esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/cyrus-clients<2.5.10-3ubuntu1.1+esm1
2.5.10-3ubuntu1.1+esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/cyrus-common<2.5.10-3ubuntu1.1+esm1
2.5.10-3ubuntu1.1+esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/cyrus-dev<2.5.10-3ubuntu1.1+esm1
2.5.10-3ubuntu1.1+esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/cyrus-imapd<2.5.10-3ubuntu1.1+esm1
2.5.10-3ubuntu1.1+esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/cyrus-murder<2.5.10-3ubuntu1.1+esm1
2.5.10-3ubuntu1.1+esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/cyrus-nntpd<2.5.10-3ubuntu1.1+esm1
2.5.10-3ubuntu1.1+esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/cyrus-pop3d<2.5.10-3ubuntu1.1+esm1
2.5.10-3ubuntu1.1+esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/cyrus-replication<2.5.10-3ubuntu1.1+esm1
2.5.10-3ubuntu1.1+esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libcyrus-imap-perl<2.5.10-3ubuntu1.1+esm1
2.5.10-3ubuntu1.1+esm1
Ubuntu Ubuntu=18.04

Event History

Jan 22, 2025
Advisory Published
via Ubuntu·12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of USN-7224-1?

The severity of USN-7224-1 is considered to be high due to the potential for privilege escalation by an unauthenticated attacker.

2

How do I fix USN-7224-1?

To fix USN-7224-1, upgrade the affected packages to version 3.8.2-1ubuntu0.1~esm1 or the latest version available.

3

What systems are affected by USN-7224-1?

USN-7224-1 affects Ubuntu 24.04 systems with the specified vulnerable cyrus packages.

4

Is USN-7224-1 related to any specific vulnerabilities?

Yes, USN-7224-1 covers multiple CVEs, including CVE-2024-34055 and CVE-2021-33582, that contribute to the security concern.

5

What are the risks of not addressing USN-7224-1?

Failing to address USN-7224-1 may allow unauthorized users to escalate their privileges and potentially compromise the affected system.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203