Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - cyrus-imapd: remote authenticated users could bypass intended access restrictions on certain server     annotations (CVE-2021-32056)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

Cyrus IMAP 3.4.1 Release Notes states :

Fixed CVE-2021-32056: Remote authenticated users could bypass intended access restrictions on certain server annotations. Additionally, a long-standing bug in replication did not allow server annotations to be replicated. Combining these two bugs, a remote authenticated user could stall replication, requiring administrator intervention.

ID	Name	Product	Family	Severity
198962	RHEL 8 : cyrus-imapd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
196828	RHEL 6 : cyrus-imapd (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
196778	RHEL 7 : cyrus-imapd (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
149374	FreeBSD : cyrus-imapd -- Remote authenticated users could bypass intended access restrictions on certain server annotations. (12156786-b18a-11eb-8cba-080027b00c2e)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2021-32056

medium

Tenable Plugins

medium

medium

high

medium