CVE-2021-33582

The Cyrus IMAP server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols.

Security Fix(es):

• cyrus-imapd: Denial of service via string hashing algorithm collisions (CVE-2021-33582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.

• CVE-2021-33582: Fix a bad string hashing algorithm which could lead to collisions and cause a CPU denial of service

• CVE-2021-33582: Fix a bad string hashing algorithm which could lead to collisions and cause a CPU denial of service

• SECURITY UPDATE: String hashing algorithm collisions
  • debian/patches/CVE-2021-33582-pre.patch: gracefully handle lookup on zero-sized tables
  • debian/patches/CVE-2021-33582-1.patch: replace ad-hoc algorithm with seeded djb2 in strhash
  • debian/patches/CVE-2021-33582-2.patch: use a seed when hashing
  • CVE-2021-33582

• SECURITY UPDATE: String hashing algorithm collisions
  • debian/patches/0021-CVE-2021-33582-pre.patch: gracefully handle lookup on zero-sized tables
  • debian/patches/0022-CVE-2021-33582.patch: replace ad-hoc algorithm with seeded djb2 and use it when hashing
  • CVE-2021-33582
• Enable the internal cunit tests
• CUnit tests:
  • debian/patches/0023-Add-unit-tests-for-strhash.patch: add unit tests for strhash and hash quality
  • debian/patches/0024-Skip-several-failed-tests.patch: skip several failed tests

• Fix CVE-2021-33582 - Denial of service via string hashing algorithm collisions

• Fix CVE-2021-33582 - Denial of service via string hashing algorithm collisions

• Fix CVE-2021-33582 - Denial of service via string hashing algorithm collisions

Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. (CVE-2021-33582)

These are all security issues fixed in the cyradm-2.4.22-2.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that non-authentication-related HTTP requests could be interpreted in an authentication context by a Cyrus IMAP Server when multiple requests arrived over the same connection. An unauthenticated attacker could possibly use this issue to perform a privilege escalation attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-18928)

Matthew Horsfall discovered that Cyrus IMAP Server utilized a poor string hashing algorithm that could be abused to control where data was being stored. An attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-33582)

Damian Poddebniak discovered that Cyrus IMAP Server could interpret specially crafted commands to exploit a memory issue. An authenticated attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-34055)