The Cyrus team is proud to announce the immediate availability of new versions
of Cyrus IMAP: 3.4.2, 3.2.8, and 3.0.16
These releases contain a fix for CVE-2021-33582. From the release notes:
> Certain user inputs are used as hash table keys during processing. A poorly
> chosen string hashing algorithm meant that the user could control which
> bucket their data was stored in, allowing a malicious user to direct many
> inputs to a single bucket. Each subsequent insertion to the same bucket
> requires a strcmp of every other entry in it. At tens of thousands of
> entries, each new insertion could keep the CPU busy in a strcmp loop for
> minutes.
>
> The string hashing algorithm has been replaced with a better one, and now
> also uses a random seed per hash table, so malicious inputs cannot be
> precomputed.
>
> Discovered by Matthew Horsfall, Fastmail
This CVE affects all previous releases of Cyrus IMAP. Corresponding fixes have
been applied to the cyrus-imapd-2.4 and cyrus-imapd-2.5 branches. If you are
still running 2.4 or 2.5 you should consider applying these patches.
Release notes:
https://www.cyrusimap.org/imap/download/release-notes/3.4/x/3.4.2.html
https://www.cyrusimap.org/imap/download/release-notes/3.2/x/3.2.8.html
https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.16.html
Download URLs:
https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.2/cyrus-imapd-3.4.2.tar.gz
https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.2/cyrus-imapd-3.4.2.tar.gz.sig
https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.2.8/cyrus-imapd-3.2.8.tar.gz
https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.2.8/cyrus-imapd-3.2.8.tar.gz.sig
https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.0.16/cyrus-imapd-3.0.16.tar.gz
https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.0.16/cyrus-imapd-3.0.16.tar.gz.sig
On behalf of the Cyrus team,
Kind regards,
ellie timoney
------------------------------------------
Cyrus: Info
Permalink:
https://cyrus.topicbox.com/groups/info/T3dde0a2352462975-Mac2dd3c2592f2267046c3442
Delivery options: https://cyrus.topicbox.com/groups/info/subscription
