CVE-2019-11356

Description

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

28.61

Associated Vulnerability

Vulnerability	OS Platform
cyrus-imapd security update(DSA-4458-1) cyrus-imapd_2.5.10-3+deb9u1_i386.deb	Linux
cyrus-imapd security update(DSA-4458-1) cyrus-imapd_2.5.10-3+deb9u1_amd64.deb	Linux
(RHSA-2019:1771) cyrus-imapd security update cyrus-imapd-3.0.7-15.el8_0.1.i686.rpm	Linux
(RHSA-2019:1771) cyrus-imapd security update cyrus-imapd-3.0.7-15.el8_0.1.x86_64.rpm	Linux
(RHSA-2019:1771) cyrus-imapd security update cyrus-imapd-debugsource-3.0.7-15.el8_0.1.i686.rpm	Linux
(RHSA-2019:1771) cyrus-imapd security update cyrus-imapd-debugsource-3.0.7-15.el8_0.1.x86_64.rpm	Linux
(RHSA-2019:1771) cyrus-imapd security update cyrus-imapd-utils-3.0.7-15.el8_0.1.x86_64.rpm	Linux
(RHSA-2019:1771) cyrus-imapd security update cyrus-imapd-vzic-3.0.7-15.el8_0.1.x86_64.rpm	Linux
An IMAP server (USN-4566-1) cyrus-admin_2.5.10-3ubuntu1.1_all.deb	Linux
An IMAP server (USN-4566-1) cyrus-imapd_2.5.10-3ubuntu1.1_i386.deb	Linux
An IMAP server (USN-4566-1) cyrus-imapd_2.5.10-3ubuntu1.1_amd64.deb	Linux
An IMAP server (USN-4566-1) cyrus-caldav_2.5.10-3ubuntu1.1_i386.deb	Linux
An IMAP server (USN-4566-1) cyrus-caldav_2.5.10-3ubuntu1.1_amd64.deb	Linux
An IMAP server (USN-4566-1) cyrus-common_2.5.10-3ubuntu1.1_i386.deb	Linux
An IMAP server (USN-4566-1) cyrus-common_2.5.10-3ubuntu1.1_amd64.deb	Linux
An IMAP server (USN-4566-1) cyrus-replication_2.5.10-3ubuntu1.1_i386.deb	Linux
An IMAP server (USN-4566-1) cyrus-replication_2.5.10-3ubuntu1.1_amd64.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234