CVE-2019-18928

NameCVE-2019-18928
DescriptionCyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cyrus-imapd (PTS)stretch (security), stretch2.5.10-3+deb9u2vulnerable
buster3.0.8-6+deb10u4fixed
buster (security)3.0.8-6+deb10u3fixed
bullseye, sid3.0.13-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cyrus-imapdsource(unstable)3.0.12-1
cyrus-imapdsourcebuster3.0.8-6+deb10u3

Notes

[stretch] - cyrus-imapd <no-dsa> (Minor issue; can be fixed via point release)
https://github.com/cyrusimap/cyrus-imapd/commit/e675bf7b0e9c6e160516d274bffaec6f9dccaef7 (cyrus-imapd-3.0.12)
Fixed in 3.0.12 and 2.5.14 upstream

Search for package or bug name: Reporting problems