Cyrus IMAP 3.4.2, 3.2.8, and 3.0.16 released

The Cyrus team is proud to announce the immediate availability of new versions of Cyrus IMAP: 3.4.2, 3.2.8, and 3.0.16

These releases contain a fix for CVE-2021-33582.  From the release notes:

> Certain user inputs are used as hash table keys during processing.  A poorly chosen string hashing algorithm meant that the user could control which bucket their data was stored in, allowing a malicious user to direct many inputs to a single bucket.  Each subsequent insertion to the same bucket requires a strcmp of every other entry in it.  At tens of thousands of entries, each new insertion could keep the CPU busy in a strcmp loop for minutes.
> 
> The string hashing algorithm has been replaced with a better one, and now also uses a random seed per hash table, so malicious inputs cannot be precomputed.
> 
> Discovered by Matthew Horsfall, Fastmail

This CVE affects all previous releases of Cyrus IMAP.  Corresponding fixes have been applied to the cyrus-imapd-2.4 and cyrus-imapd-2.5 branches.  If you are still running 2.4 or 2.5 you should consider applying these patches.

Release notes:

    https://www.cyrusimap.org/imap/download/release-notes/3.4/x/3.4.2.html
    https://www.cyrusimap.org/imap/download/release-notes/3.2/x/3.2.8.html
    https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.16.html

Download URLs:

    https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.2/cyrus-imapd-3.4.2.tar.gz
    https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.2/cyrus-imapd-3.4.2.tar.gz.sig    

    https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.2.8/cyrus-imapd-3.2.8.tar.gz
    https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.2.8/cyrus-imapd-3.2.8.tar.gz.sig    

    https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.0.16/cyrus-imapd-3.0.16.tar.gz
    https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.0.16/cyrus-imapd-3.0.16.tar.gz.sig    

On behalf of the Cyrus team,

Kind regards,

ellie timoney

------------------------------------------
Cyrus: Info
Permalink: https://cyrus.topicbox.com/groups/info/T3dde0a2352462975-Mac2dd3c2592f2267046c3442
Delivery options: https://cyrus.topicbox.com/groups/info/subscription