The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3492 advisory.

  - cyrus-imapd: Denial of service via string hashing algorithm collisions (CVE-2021-33582)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3052 advisory.

  - Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request     may be interpreted in the authentication context of an unrelated previous request that arrived over the     same connection. (CVE-2019-18928)

  - Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang)     via input that is mishandled during hash-table interaction. Because there are many insertions into a     single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16. (CVE-2021-33582)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0067 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-18928:
    Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request     may be interpreted in the authentication context of an unrelated previous request that arrived over the     same connection.

    CVE-2019-19783:
    An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If     sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user     with a mail account on the service can use a sieve script containing a fileinto directive to create any     mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in     imap/lmtp_sieve.c.

    CVE-2021-33582:
    Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang)     via input that is mishandled during hash-table interaction. Because there are many insertions into a     single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-3492 advisory.

    [3.0.7-20.1]
    - Fix for CVE-2021-33582

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3546 advisory.

    The Cyrus IMAP server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar     and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols.

    Security Fix(es):

    * cyrus-imapd: Denial of service via string hashing algorithm collisions (CVE-2021-33582)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0245 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2021-33582:
      Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon     hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a     single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
153411	CentOS 8 : cyrus-imapd (CESA-2021:3492)	Nessus	CentOS Local Security Checks	2021/9/15	2021/9/15	high
162402	Debian DLA-3052-1 : cyrus-imapd - LTS security update	Nessus	Debian Local Security Checks	2022/6/20	2022/6/20	critical
236563	Alibaba Cloud Linux 3 : 0067: cyrus-imapd (ALINUX3-SA-2021:0067)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
153240	Oracle Linux 8 : cyrus-imapd (ELSA-2021-3492)	Nessus	Oracle Linux Local Security Checks	2021/9/13	2024/11/1	high
153404	RHEL 8 : cyrus-imapd (RHSA-2021:3546)	Nessus	Red Hat Local Security Checks	2021/9/15	2024/11/7	high
239739	TencentOS Server 3: cyrus-imapd (TSSA-2022:0245)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high

检测

插件搜索

high

critical

critical

high

high

high