[ GLSA 202006-23 ] Cyrus IMAP Server

[GLSA]

Gentoo Linux Security Advisory

Title: Cyrus IMAP Server: Access restriction bypass (GLSA 202006-23)
Severity: normal
Exploitable: remote
Date: 2020-06-15
Bug(s): #703630
ID: 202006-23

Synopsis

An error in Cyrus IMAP Server allows mailboxes to be created with
administrative privileges.


Background

The Cyrus IMAP Server is an efficient, highly-scalable IMAP e-mail
server.


Affected Packages

Package: net-mail/cyrus-imapd
Vulnerable: < 3.0.13
Unaffected: >= 3.0.13
Architectures: All supported architectures


Description

An issue was discovered in Cyrus IMAP Server where sieve script
uploading is excessively trusted.


Impact

A user can use a sieve script to create any mailbox with administrator
privileges.


Workaround

Disable sieve script uploading until the upgrade is complete.

Resolution

All Cyrus IMAP Server users should upgrade to the latest version: