The Cyrus team is proud to announce the immediate availability of new versions of Cyrus IMAP: 3.8.3, 3.6.5, and 3.4.8
These releases contain a fix for CVE-2024-34055 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34055>. From the release notes: > Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow authenticated attackers to > cause unbounded memory allocation by sending many LITERALs in a single > command. > > The IMAP protocol allows for command arguments to be LITERALs of negotiated > length, and for these the server allocates memory to receive the content > before instructing the client to proceed. The allocated memory is released > when the whole command has been received and processed. > > The IMAP protocol has a number commands that specify an unlimited number of > arguments, for example SEARCH. Each of these arguments can be a LITERAL, for > which memory will be allocated and not released until the entire command has > been received and processed. This can run a server out of memory, with > varying consequences depending on the server's OOM policy. > > Discovered by Damian Poddebniak. This issue affects all previous Cyrus IMAP releases. The updated versions introduce two new imapd.conf limits (maxargssize, maxliteral) that operators can configure with safe values for their environment. Please see the release notes and other documentation for full details. These changes were too intrusive to backport to any earlier versions. If you are running Cyrus IMAP version 3.2 or earlier, we suggest upgrading to at least 3.4.8, especially if your service has untrusted users. Release notes: https://www.cyrusimap.org/3.8/imap/download/release-notes/3.8/x/3.8.3.html https://www.cyrusimap.org/3.6/imap/download/release-notes/3.6/x/3.6.5.html https://www.cyrusimap.org/3.4/imap/download/release-notes/3.4/x/3.4.8.html Download URLs: https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.8.3/cyrus-imapd-3.8.3.tar.gz https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.8.3/cyrus-imapd-3.8.3.tar.gz.sig https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.6.5/cyrus-imapd-3.6.5.tar.gz https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.6.5/cyrus-imapd-3.6.5.tar.gz.sig https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.8/cyrus-imapd-3.4.8.tar.gz https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.8/cyrus-imapd-3.4.8.tar.gz.sig On behalf of the Cyrus team, ellie timoney ------------------------------------------ Cyrus: Info Permalink: https://cyrus.topicbox.com/groups/info/Ta8e3998446caf7f8-M62aeba01c9f896f5b1ffb7d2 Delivery options: https://cyrus.topicbox.com/groups/info/subscription
