Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-33582: A flaw was found in cyrus-imapd. A bad string hashing algorithm used in internal hash tables allows user inputs to be stored in predictable buckets. A user may cause a CPU denial of service by maliciously directing many inputs to a single bucket. The highest threat from this vulnerability is to system availability. 1993232: CVE-2021-33582 cyrus-imapd: Denial of service via string hashing algorithm collisions
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | cyrus-imapd | 0:2.4.22-1.amzn2.0.1 |
| Amazon Linux · 2 | cyrus-imapd-debuginfo | 0:2.4.22-1.amzn2.0.1 |
| Amazon Linux · 2 | cyrus-imapd-devel | 0:2.4.22-1.amzn2.0.1 |
| Amazon Linux · 2 | cyrus-imapd-utils | 0:2.4.22-1.amzn2.0.1 |
Vulnerabilities 1
-
Unscored —
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input th…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-33582.html