PT-2019-2928 · Cyrus+4 · Cyrus Imap+4

Published 2019-06-03 · Updated 2025-04-04 · CVE-2019-11356

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cyrus IMAP versions 2.5.x through 2.5.12 Cyrus IMAP versions 3.0.x through 3.0.9

Description The issue is related to the CalDAV feature in the httpd server of Cyrus IMAP, which allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name. This can lead to data integrity issues, access to confidential data, denial of service, and arbitrary code execution.

Recommendations For versions 2.5.x through 2.5.12, consider disabling the CalDAV feature until a patch is available. For versions 3.0.x through 3.0.9, restrict access to the HTTP PUT operation for events with long iCalendar property names to minimize the risk of exploitation. As a temporary workaround, consider disabling the httpd server or restricting its functionality until a patch is available.

Fix

RCE

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

ALT-PU-2019-2469

ALT-PU-2019-2472

BDU:2019-02901

CESA-2019_1771

CVE-2019-11356

DSA-4458-1

MGASA-2019-0219

OPENSUSE-SU-2025:14968-1

RHSA-2019:1771

RHSA-2019_1771

USN-4566-1

Affected Products

Alt Linux

Centos

Cyrus Imap

Red Hat

Ubuntu

References · 44

• https://ubuntu.com/security/CVE-2019-19783 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11356 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:1771 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11356 · Vendor Advisory
• https://usn.ubuntu.com/4566-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4458-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19783 · Security Note
• https://osv.dev/vulnerability/MGASA-2019-0219 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PICSZDC3UGEUZ27VXGGM6OFI67D3KKLZ · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-11356 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2019-1771.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/cyrus-imapd · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/IGO43JS7IFDNITHXOOHOP6JHRKRDIYY6 · Vendor Advisory
• https://debian.org/security/2019/dsa-4458 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11356 · Security Note