Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1069390

Bug#993492: buster-pu: package cyrus-imapd/3.0.8-6+deb10u6

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Package: release.debian.org
Severity: normal
Tags: buster
User: release.debian.org@packages.debian.org
Usertags: pu

[ Reason ]
cyrus-imapd before 3.0.16 allows remote attackers to cause a denial of
service (multiple-minute daemon hang) via input that is mishandled
during hash-table interaction. Because there are many insertions into
a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8,
and 3.0.16.

[ Impact ]
Medium vulnerability

[ Tests ]
The new cunit/strhash.testc passed.

[ Risks ]
Low risk, patch is easy to read

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable

[ Changes ]
New string hashing algorithm and test.

Cheers,
Yadd

Back to linux.debian.bugs.dist | Previous | Next | Find similar | Unroll thread

Thread

Bug#993492: buster-pu: package cyrus-imapd/3.0.8-6+deb10u6 Yadd <yadd@debian.org> - 2021-09-02 08:10 +0200

csiph-web