Red Hat Security AdvisoryRHSA-2011:0859
cyrus-imapd security update
Released 2011-06-08 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5.6.z server) cyrus-imapd-2.3.7-7.el5_6.4, cyrus-imapd-2.3.7-7.el5_6.4.i386, cyrus-imapd-2.3.7-7.el5_6.4.ia64 +13
- Red Hat Enterprise Linux AS version 4 cyrus-imapd-2.2.12-15.el4, cyrus-imapd-2.2.12-15.el4.i386, cyrus-imapd-2.2.12-15.el4.ia64 +21
- Red Hat Enterprise Linux Desktop version 4 cyrus-imapd-2.2.12-15.el4, cyrus-imapd-2.2.12-15.el4.i386, cyrus-imapd-devel-2.2.12-15.el4 +9
- Red Hat Enterprise Linux ES version 4 cyrus-imapd-2.2.12-15.el4, cyrus-imapd-2.2.12-15.el4.i386, cyrus-imapd-2.2.12-15.el4.ia64 +15
- Red Hat Enterprise Linux Server (v. 6) cyrus-imapd-2.3.16-6.el6_1.2, cyrus-imapd-utils-2.3.16-6.el6_1.2
- Red Hat Enterprise Linux Server Optional (v. 6) cyrus-imapd-2.3.16-6.el6_1.2, cyrus-imapd-devel-2.3.16-6.el6_1.2, cyrus-imapd-devel-2.3.16-6.el6_1.2.ppc
- Red Hat Enterprise Linux WS version 4 cyrus-imapd-2.2.12-15.el4, cyrus-imapd-2.2.12-15.el4.i386, cyrus-imapd-2.2.12-15.el4.ia64 +15
Fixes 1 record
Priority LOW 30
The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command t…
CVSS 2.0MEDIUM 5.1· Network · No auth · Interaction — · EPSS 0.03999 · Published 2011-05-23 · Fixed CWE-264
