Back to Database
Status published
Critical
CVE-2019-11356
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through...
Vulnerability Description
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-11356
Credits & Attribution
No credits recorded in the NVD database.
References
- https://www.cyrusimap.org/imap/download/release-notes/2.5/index.html
- https://www.cyrusimap.org/imap/download/release-notes/3.0/index.html
- https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.13.html
- https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.10.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGO43JS7IFDNITHXOOHOP6JHRKRDIYY6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PICSZDC3UGEUZ27VXGGM6OFI67D3KKLZ/
- https://www.debian.org/security/2019/dsa-4458
- https://seclists.org/bugtraq/2019/Jun/9
- https://access.redhat.com/errata/RHSA-2019:1771
- https://usn.ubuntu.com/4566-1/
More from cyrus
View All →CVE-2021-33582
Cyrus IMAP before 3.4.2 allows remote attackers to cause a...
High
7.5
CVE-2021-32056
Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1,...
Medium
4.3
CVE-2019-19783
An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x...
Medium
6.5
CVE-2019-18928
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows...
Critical
9.8
CVE-2017-14230
In the mboxlist_do_find function in imap/mboxlist.c in Cyrus IMAP before...
Critical
9.1
Affected Vendor
cyrus
View all reports →Affected Software
imap, fedora, debian linux, ubuntu linux, enterprise linux, enterprise linux eus, enterprise linux server aus, enterprise linux server tus
Vulnerable Versions:
2.5.0, 3.0.0, 29, 30, 9.0, 18.04, 8.0, 8.1, 8.2, 8.4
Timeline
Official Publish:
June 3rd, 2019
Last Modified:
August 4th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.