UBUNTU-CVE-2021-33582

Dashboard / Vulnerabilities / UBUNTU-CVE-2021-33582

UBUNTU-CVE-2021-33582

Published: 1 Sept 2021Last Modified: 22 Apr 2026

Upstream:

CVE-2021-33582

Aliases:

Summary:

Details: Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.

References: https://ubuntu.com/security/CVE-2021-33582, https://github.com/cyrusimap/cyrus-imapd/commit/93901789300aeefbe5c5829f2ab938e567a796dd, https://github.com/cyrusimap/cyrus-imapd/commit/768b3aa4f51b636f0c591b6b34dd96aab9ce0136, https://github.com/cyrusimap/cyrus-imapd/commit/3411deb448d29f4d287e90272dfa70d6f067ca67, https://github.com/cyrusimap/cyrus-imapd/commit/810bb164a805395cd7a42412644f1d595e6b105e, https://github.com/cyrusimap/cyrus-imapd/commit/943d4c37a063d2cf3384a88df9b884a167c04468, https://www.cyrusimap.org/imap/download/release-notes/3.2/x/3.2.8.html, https://www.cyrusimap.org/imap/download/release-notes/3.4/x/3.4.2.html, https://www.cyrusimap.org/imap/download/release-notes/3.2/x/3.2.8.html, https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.16.html, https://www.cve.org/CVERecord?id=CVE-2021-33582, https://ubuntu.com/security/notices/USN-7224-1

Affected packages

Package

Name: cyrus-imapd-2.4

Purl: pkg:deb/ubuntu/[email protected]?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 0

Fixed -None

Affected versions

2.4.17+caldav~beta10-18

2.4.17+nocaldav-2

2.4.18-3

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High