The Cyrus team is proud to announce the immediate availability of new versions of Cyrus IMAP: 3.8.3, 3.6.5, and 3.4.8
These releases contain a fix for CVE-2024-34055. From the release notes:
Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.The IMAP protocol allows for command arguments to be LITERALs of negotiated length, and for these the server allocates memory to receive the content before instructing the client to proceed. The allocated memory is released when the whole command has been received and processed.The IMAP protocol has a number commands that specify an unlimited number of arguments, for example SEARCH. Each of these arguments can be a LITERAL, for which memory will be allocated and not released until the entire command has been received and processed. This can run a server out of memory, with varying consequences depending on the server's OOM policy.Discovered by Damian Poddebniak.
This issue affects all previous Cyrus IMAP releases.
The updated versions introduce two new imapd.conf limits (maxargssize, maxliteral) that operators can configure with safe values for their environment. Please see the release notes and other documentation for full details.
These changes were too intrusive to backport to any earlier versions. If you are running Cyrus IMAP version 3.2 or earlier, we suggest upgrading to at least 3.4.8, especially if your service has untrusted users.
Release notes:
Download URLs:
On behalf of the Cyrus team,
ellie timoney
