Input validation error in Cyrus IMAP Server - CVE-2021-33582

Vulnerability identifier: #VU59879

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-33582

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input that is mishandled during hash-table interaction. A remote attacker can cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow.

Cyrus IMAP Server
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
cyrus-imapd
cyrus-imapd-utils
cyrus-imapd-vzic
cyrus-imapd (Red Hat package)

Install update from vendor's website.

Cyrus IMAP Server - addressed in versions 3.0.16, 3.2.8, 3.4.2
cyrus-imapd - addressed in versions 3.0.7-16, 3.0.7-20
cyrus-imapd-utils - addressed in versions 3.0.7-16, 3.0.7-20
cyrus-imapd-vzic - addressed in versions 3.0.7-16, 3.0.7-20
cyrus-imapd (Red Hat package) - addressed in versions 3.0.7-16.el8_1.1, 3.0.7-16.el8_2.1, 3.0.7-20.el8_4.1

• https://www.cyrusimap.org/imap/download/release-notes/index.html
• https://github.com/cyrusimap/cyrus-imapd/commits/master
• https://cyrus.topicbox.com/groups/announce/T3dde0a2352462975-M1386fc44adf967e072f8df13/cyrus-imap-3-4-2-3-2-8-and-3-0-16-released
• https://github.com/cyrusimap/cyrus-imapd/security/advisories

• Denial of service in Cyrus IMAP
• Amazon Linux AMI update for cyrus-imapd
• Red Hat Enterprise Linux 8 update for cyrus-imapd
• Red Hat Enterprise Linux 8.2 Extended Update Support update for cyrus-imapd
• Red Hat Enterprise Linux 8.1 Extended Update Support update for cyrus-imapd
• Anolis OS update for cyrus-imapd (Anolis OS 8.2)
• Anolis OS update for cyrus-imapd (Anolis OS 8.4)