Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Imap | Cyrus | * | 3.0.16 (excluding) |
| Imap | Cyrus | 3.2.0 (including) | 3.2.8 (excluding) |
| Imap | Cyrus | 3.4.0 (including) | 3.4.2 (excluding) |