VDB
CVE-2011-1926
CVE-2011-1926
PUBLISHED
CVSS 5.099999904632568 MEDIUM
The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
EPSS 4.00% · 90.2th percentile
Risk Scores
CVSS 2.0
5.099999904632568
EPSS Score
4.00%
90.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| cmu | cyrus_imap_server | 2.3.13, 0, 2.0.17 |
| n/a | n/a | n/a |
Timeline
- May 23, 2011 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Dec 19, 2022 EPSS Score
- Feb 10, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 27, 2023 EPSS Score
- Jul 19, 2023 EPSS Score
- Sep 9, 2023 EPSS Score
References
- FEDORA-2011-7193 vendor-advisory
- [oss-security] 20110517 Re: CVE Request -- Cyrus-IMAP STARTTLS issue -- [was: Re: pure-ftpd STARTTLS command injection / new CVE?] mailing-list
- RHSA-2011:0859 vendor-advisory
- MDVSA-2011:100 vendor-advisory
- 1025625 vdb
- http://bugzilla.cyrusimap.org/show_bug.cgi?id=3423 url
- 44928 third-party-advisory
- 44670 third-party-advisory
- http://bugzilla.cyrusimap.org/show_bug.cgi?id=3424 patch
- http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061374.html technical
- http://secunia.com/advisories/44876 technical
- http://www.debian.org/security/2011/dsa-2258 technical
- http://secunia.com/advisories/44913 technical
- http://www.debian.org/security/2011/dsa-2242 technical
- https://bugzilla.redhat.com/show_bug.cgi?id=705288 patch
- https://nvd.nist.gov/vuln/detail/CVE-2011-1926 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67867 url
- http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162 url
- http://openwall.com/lists/oss-security/2011/05/17/2 url
- http://www.cyrusimap.org/docs/cyrus-imapd/2.4.7/changes.php url
…and 1 more