CVE-2019-18928

NameCVE-2019-18928
DescriptionCyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3052-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cyrus-imapd (PTS)buster3.0.8-6+deb10u6fixed
buster (security)3.0.8-6+deb10u3fixed
bullseye3.2.6-2+deb11u2fixed
bookworm, sid3.6.0~beta2-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cyrus-imapdsourcestretch2.5.10-3+deb9u3DLA-3052-1
cyrus-imapdsourcebuster3.0.8-6+deb10u3
cyrus-imapdsource(unstable)3.0.12-1

Notes

https://github.com/cyrusimap/cyrus-imapd/commit/e675bf7b0e9c6e160516d274bffaec6f9dccaef7 (cyrus-imapd-3.0.12)
Fixed in 3.0.12 and 2.5.14 upstream

Search for package or bug name: Reporting problems