CVE-2021-33582 Denial of service in n/a

High 7.5 Published 1 Sep 2021 Updated 3 Aug 2024

Remote attackers can cause a denial of service in Cyrus IMAP by triggering slow hash-table interactions, requiring an upgrade to fixed versions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-33582?

CVE-2021-33582 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 1 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.

Weakness: CWE-407

Which versions are affected by CVE-2021-33582?

It affects 3 products.

Linux distribution packages (23)

`cyrus-imapd` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.7-20.el8_4.1`
`cyrus-imapd-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.7-20.el8_4.1`
`cyrus-imapd-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.7-20.el8_4.1`
`cyrus-imapd-utils` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.7-20.el8_4.1`
`cyrus-imapd-utils-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.7-20.el8_4.1`
`cyrus-imapd-vzic` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.7-20.el8_4.1`
`cyrus-imapd-vzic-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.7-20.el8_4.1`
`cyrus-imapd` Red Hat:rhel_eus:8.1::appstream	All versions	`0:3.0.7-16.el8_1.1`
`cyrus-imapd-debuginfo` Red Hat:rhel_eus:8.1::appstream	All versions	`0:3.0.7-16.el8_1.1`
`cyrus-imapd-debugsource` Red Hat:rhel_eus:8.1::appstream	All versions	`0:3.0.7-16.el8_1.1`
`cyrus-imapd-utils` Red Hat:rhel_eus:8.1::appstream	All versions	`0:3.0.7-16.el8_1.1`
`cyrus-imapd-utils-debuginfo` Red Hat:rhel_eus:8.1::appstream	All versions	`0:3.0.7-16.el8_1.1`
`cyrus-imapd-vzic` Red Hat:rhel_eus:8.1::appstream	All versions	`0:3.0.7-16.el8_1.1`
`cyrus-imapd-vzic-debuginfo` Red Hat:rhel_eus:8.1::appstream	All versions	`0:3.0.7-16.el8_1.1`
`cyrus-imapd` Red Hat:rhel_eus:8.2::appstream	All versions	`0:3.0.7-16.el8_2.1`
`cyrus-imapd-debuginfo` Red Hat:rhel_eus:8.2::appstream	All versions	`0:3.0.7-16.el8_2.1`
`cyrus-imapd-debugsource` Red Hat:rhel_eus:8.2::appstream	All versions	`0:3.0.7-16.el8_2.1`
`cyrus-imapd-utils` Red Hat:rhel_eus:8.2::appstream	All versions	`0:3.0.7-16.el8_2.1`
`cyrus-imapd-utils-debuginfo` Red Hat:rhel_eus:8.2::appstream	All versions	`0:3.0.7-16.el8_2.1`
`cyrus-imapd-vzic` Red Hat:rhel_eus:8.2::appstream	All versions	`0:3.0.7-16.el8_2.1`
`cyrus-imapd-vzic-debuginfo` Red Hat:rhel_eus:8.2::appstream	All versions	`0:3.0.7-16.el8_2.1`
`cyrus-imapd` Rocky Linux:8	All versions	`0:3.0.7-20.el8_4.1`
`cyrus-imapd` openSUSE:Tumbleweed	All versions	`2.4.22-2.1`

Products include Cyrus Imap, Debian Debian Linux, Fedoraproject Fedora.

How do I fix CVE-2021-33582?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-33582 being exploited?

There is no known exploitation of CVE-2021-33582 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as CLSA-2022-1654106950, CLSA-2022-1654107183, CLSA-2022-1654174467, CLSA-2023-1688678110, CLSA-2026-1777279920, CLSA-2026-1777280127 and 10 more.