Issued:
2019-07-15
Updated:
2019-07-15

RHSA-2019:1771 - Security Advisory

Synopsis

Important: cyrus-imapd security update

Type/Severity

Security Advisory: Important

Topic

An update for cyrus-imapd is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and SIEVE support.

Security Fix(es):

  • cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name (CVE-2019-11356)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 1717828 - CVE-2019-11356 cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name

CVEs

References

Red Hat Enterprise Linux for x86_64 8

SRPM
cyrus-imapd-3.0.7-15.el8_0.1.src.rpm SHA-256: 8dc0221a8c153c384df40aca2ea0cd50436244ee5bbc5c66bd3c292c1bb3ff2a
x86_64
cyrus-imapd-3.0.7-15.el8_0.1.i686.rpm SHA-256: 1501f17c2556aaa718731f2c1a0f72c1a582734581b2d90c434375486f90c975
cyrus-imapd-3.0.7-15.el8_0.1.x86_64.rpm SHA-256: 91e5344f805500f9b6701b243e87175e47b473e2b4a642ca0681120446a24ae7
cyrus-imapd-debuginfo-3.0.7-15.el8_0.1.i686.rpm SHA-256: d10b3de0c6df1cbe85887fd7f33463d032881fd743d7cd7297ddedf84f12bf68
cyrus-imapd-debuginfo-3.0.7-15.el8_0.1.x86_64.rpm SHA-256: 800923632233665159f1ecac4f049b152ed90fd82d140c81752be1dcc0d3ce7a
cyrus-imapd-debugsource-3.0.7-15.el8_0.1.i686.rpm SHA-256: 6d99a8d081470b977af539235e4b5dd56fff9fa58857457a4bfac7277db47f4c
cyrus-imapd-debugsource-3.0.7-15.el8_0.1.x86_64.rpm SHA-256: 1cb7b4d28d4be4268492808084eeffc8bbf5e41a957f51e1cd9993d667cd3f5d
cyrus-imapd-utils-3.0.7-15.el8_0.1.x86_64.rpm SHA-256: d7110389331130cf46609e556911b8a90d3b1d3ecb2e80373d887f4334e35c1e
cyrus-imapd-utils-debuginfo-3.0.7-15.el8_0.1.i686.rpm SHA-256: 266e8f74366041d9782c2bda532301180eaa49fe3c1c46c902bcc306d26c682d
cyrus-imapd-utils-debuginfo-3.0.7-15.el8_0.1.x86_64.rpm SHA-256: 23b954b244cd9eb9bbbe8ae83902a51c9f23d7c05afccf174ed7dcae9eb0ca3a
cyrus-imapd-vzic-3.0.7-15.el8_0.1.x86_64.rpm SHA-256: e8c72b5ec901804fec3aebc3f8d13e21ae2d35aceb27e895a738311a60af1c69
cyrus-imapd-vzic-debuginfo-3.0.7-15.el8_0.1.i686.rpm SHA-256: 09ce8999889754384d67f9624bef96cd5e4016fc859243c88da07a2c1eae3a98
cyrus-imapd-vzic-debuginfo-3.0.7-15.el8_0.1.x86_64.rpm SHA-256: e4f32f1ded9e6751ab64217df368699e07c953527dbfb014bcaaa2bed281929d

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
cyrus-imapd-3.0.7-15.el8_0.1.src.rpm SHA-256: 8dc0221a8c153c384df40aca2ea0cd50436244ee5bbc5c66bd3c292c1bb3ff2a
s390x
cyrus-imapd-3.0.7-15.el8_0.1.s390x.rpm SHA-256: 10b86b12301b852f9c5e03cb9790d0b3c668bec2738d1e4da64c7e81732093fd
cyrus-imapd-debuginfo-3.0.7-15.el8_0.1.s390x.rpm SHA-256: 62fcc75f7ce8ecc489ca2b66dc6199d35d7875c4f24aefe4aadba84957758134
cyrus-imapd-debugsource-3.0.7-15.el8_0.1.s390x.rpm SHA-256: 7e32e3d8895df3d27f73056aa9c81d4f5657399d7028f03e66f65cfc42e8c21a
cyrus-imapd-utils-3.0.7-15.el8_0.1.s390x.rpm SHA-256: 395ba2b2560fb43da7fb0856f17d3d9eeee82f2cb547c22a0bec2af9e55d11d7
cyrus-imapd-utils-debuginfo-3.0.7-15.el8_0.1.s390x.rpm SHA-256: 67f95fee1a5f51013184940773eac8b04a604b43b7347519f8a19f31a108ca52
cyrus-imapd-vzic-3.0.7-15.el8_0.1.s390x.rpm SHA-256: 407a2d3f333ba867969c440d0ae34e95df64080a50c65cf09818a62c5329a965
cyrus-imapd-vzic-debuginfo-3.0.7-15.el8_0.1.s390x.rpm SHA-256: 36d99f2e93c87e2c580953589a9837b6f2b68fe62a320754cb0c982279102977

Red Hat Enterprise Linux for Power, little endian 8

SRPM
cyrus-imapd-3.0.7-15.el8_0.1.src.rpm SHA-256: 8dc0221a8c153c384df40aca2ea0cd50436244ee5bbc5c66bd3c292c1bb3ff2a
ppc64le
cyrus-imapd-3.0.7-15.el8_0.1.ppc64le.rpm SHA-256: 8de6d655435c19f4773ddcdc8c10a32c0939fe252906c72176551020ed5661db
cyrus-imapd-debuginfo-3.0.7-15.el8_0.1.ppc64le.rpm SHA-256: c40ae9788b7957bfa77e082953e2e061aa591bfca6ed66785aca329399695e11
cyrus-imapd-debugsource-3.0.7-15.el8_0.1.ppc64le.rpm SHA-256: 50157ad5935aa3349f792b0138053cfa2a3bfc754481c42bba7f84f1afe77187
cyrus-imapd-utils-3.0.7-15.el8_0.1.ppc64le.rpm SHA-256: c9e7406cc7894fb07f3a5af3b76d89608840e0374a1d9a5597ad720f0bf9cac6
cyrus-imapd-utils-debuginfo-3.0.7-15.el8_0.1.ppc64le.rpm SHA-256: f0ac4f9bcf30d29a7295054a2d66c769409e6c277b9735cd74039fdbde12a27b
cyrus-imapd-vzic-3.0.7-15.el8_0.1.ppc64le.rpm SHA-256: 276a60cf856d8c8e0dd4fdb7b269e0ac1636792adcd2a4c4598053393e5213d1
cyrus-imapd-vzic-debuginfo-3.0.7-15.el8_0.1.ppc64le.rpm SHA-256: 276f9fdf57bda297d39d374025a972bcd74be78b93b7067e6e83e0b9ba29cc8e

Red Hat Enterprise Linux for ARM 64 8

SRPM
cyrus-imapd-3.0.7-15.el8_0.1.src.rpm SHA-256: 8dc0221a8c153c384df40aca2ea0cd50436244ee5bbc5c66bd3c292c1bb3ff2a
aarch64
cyrus-imapd-3.0.7-15.el8_0.1.aarch64.rpm SHA-256: f313978e71821678c6c64d569f967058604ab88e3648fb915527401ac6d52470
cyrus-imapd-debuginfo-3.0.7-15.el8_0.1.aarch64.rpm SHA-256: ce9c99fb6cec7854aa533501283df993d7b6506a50b62991f4926037b8f3be6d
cyrus-imapd-debugsource-3.0.7-15.el8_0.1.aarch64.rpm SHA-256: 174f5bb49b1d696e926f2e6a4bc90c81c2bdd5c55ce8e9ed9f9af8ec5cfa0485
cyrus-imapd-utils-3.0.7-15.el8_0.1.aarch64.rpm SHA-256: d83f51c2026a42bec03cf661b7bae654288f70d05e2bf886deb6a191a5bc0102
cyrus-imapd-utils-debuginfo-3.0.7-15.el8_0.1.aarch64.rpm SHA-256: f632a5582853d8ec420f41d1317ceeeb5ad9639914e139ed9b06c94660169e20
cyrus-imapd-vzic-3.0.7-15.el8_0.1.aarch64.rpm SHA-256: 039efec187a0abe5847b16be0b79a2e24146664a52a97d7784693b4c28be8787
cyrus-imapd-vzic-debuginfo-3.0.7-15.el8_0.1.aarch64.rpm SHA-256: 0450f48e33c549c32c36ca7f9088c1f56ae045b44b290e5262452d91775ffad7

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.