Hi,
We've become aware that the fixes for CVE-2024-34055 break communications with the mupdate service in Cyrus Murder deployments (https://github.com/cyrusimap/cyrus-imapd/issues/4932)
We're working on a fix, and will publish new releases when it's ready. Murder deployments should avoid upgrading to the current versions, and wait for the next set of releases instead.
Sorry for the inconvenience,
ellie
On Wed, 5 Jun 2024, at 12:41 PM, ellie timoney wrote:
The Cyrus team is proud to announce the immediate availability of new versions of Cyrus IMAP: 3.8.3, 3.6.5, and 3.4.8These releases contain a fix for CVE-2024-34055. From the release notes:Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.The IMAP protocol allows for command arguments to be LITERALs of negotiated length, and for these the server allocates memory to receive the content before instructing the client to proceed. The allocated memory is released when the whole command has been received and processed.The IMAP protocol has a number commands that specify an unlimited number of arguments, for example SEARCH. Each of these arguments can be a LITERAL, for which memory will be allocated and not released until the entire command has been received and processed. This can run a server out of memory, with varying consequences depending on the server's OOM policy.Discovered by Damian Poddebniak.This issue affects all previous Cyrus IMAP releases.The updated versions introduce two new imapd.conf limits (maxargssize, maxliteral) that operators can configure with safe values for their environment. Please see the release notes and other documentation for full details.These changes were too intrusive to backport to any earlier versions. If you are running Cyrus IMAP version 3.2 or earlier, we suggest upgrading to at least 3.4.8, especially if your service has untrusted users.Release notes:Download URLs:On behalf of the Cyrus team,ellie timoney
