CVE-2021-33582

Cyrus IMAP versiones anteriores a 3.4.2, permite a atacantes remotos causar una denegación de servicio (cuelgue del demonio de varios minutos) por medio de una entrada manejada inapropiadamente durante la interacción de la tabla hash. Debido a que presenta muchas inserciones en un solo cubo, strcmp se vuelve lento. Esto se ha corregido en las versiones 3.4.2, 3.2.8 y 3.0.16

A flaw was found in cyrus-imapd. A bad string hashing algorithm used in internal hash tables allows user inputs to be stored in predictable buckets. A user may cause a CPU denial of service by maliciously directing many inputs to a single bucket. The highest threat from this vulnerability is to system availability.

It was discovered that non-authentication-related HTTP requests could be interpreted in an authentication context by a Cyrus IMAP Server when multiple requests arrived over the same connection. An unauthenticated attacker could possibly use this issue to perform a privilege escalation attack. This issue only affected Ubuntu 18.04 LTS. Matthew Horsfall discovered that Cyrus IMAP Server utilized a poor string hashing algorithm that could be abused to control where data was being stored. An attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.