{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2011-03-25T00:00:00", "descriptions": [{"lang": "en", "value": "The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a \"plaintext command injection\" attack, a similar issue to CVE-2011-0411."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "RHSA-2011:0859", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://www.redhat.com/support/errata/RHSA-2011-0859.html"}, {"name": "FEDORA-2011-7217", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061374.html"}, {"name": "DSA-2258", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2011/dsa-2258"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.cyrusimap.org/docs/cyrus-imapd/2.4.7/changes.php"}, {"name": "MDVSA-2011:100", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:100"}, {"name": "FEDORA-2011-7193", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061415.html"}, {"name": "1025625", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1025625"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bugzilla.cyrusimap.org/show_bug.cgi?id=3423"}, {"name": "DSA-2242", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2011/dsa-2242"}, {"name": "44876", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/44876"}, {"name": "[oss-security] 20110517 CVE Request -- Cyrus-IMAP STARTTLS issue -- [was: Re: pure-ftpd STARTTLS command injection / new CVE?]", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://openwall.com/lists/oss-security/2011/05/17/2"}, {"name": "VU#555316", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "http://www.kb.cert.org/vuls/id/555316"}, {"name": "44928", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/44928"}, {"name": "44913", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/44913"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bugzilla.cyrusimap.org/show_bug.cgi?id=3424"}, {"name": "44670", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/44670"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=705288"}, {"name": "cyrus-starttls-command-exec(67867)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/67867"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162"}, {"name": "[oss-security] 20110517 Re: CVE Request -- Cyrus-IMAP STARTTLS issue -- [was: Re: pure-ftpd STARTTLS command injection / new CVE?]", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://openwall.com/lists/oss-security/2011/05/17/15"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T22:46:00.659Z"}, "title": "CVE Program Container", "references": [{"name": "RHSA-2011:0859", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://www.redhat.com/support/errata/RHSA-2011-0859.html"}, {"name": "FEDORA-2011-7217", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061374.html"}, {"name": "DSA-2258", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2011/dsa-2258"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.cyrusimap.org/docs/cyrus-imapd/2.4.7/changes.php"}, {"name": "MDVSA-2011:100", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:100"}, {"name": "FEDORA-2011-7193", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061415.html"}, {"name": "1025625", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1025625"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugzilla.cyrusimap.org/show_bug.cgi?id=3423"}, {"name": "DSA-2242", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2011/dsa-2242"}, {"name": "44876", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/44876"}, {"name": "[oss-security] 20110517 CVE Request -- Cyrus-IMAP STARTTLS issue -- [was: Re: pure-ftpd STARTTLS command injection / new CVE?]", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://openwall.com/lists/oss-security/2011/05/17/2"}, {"name": "VU#555316", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "http://www.kb.cert.org/vuls/id/555316"}, {"name": "44928", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/44928"}, {"name": "44913", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/44913"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugzilla.cyrusimap.org/show_bug.cgi?id=3424"}, {"name": "44670", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/44670"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=705288"}, {"name": "cyrus-starttls-command-exec(67867)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/67867"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162"}, {"name": "[oss-security] 20110517 Re: CVE Request -- Cyrus-IMAP STARTTLS issue -- [was: Re: pure-ftpd STARTTLS command injection / new CVE?]", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://openwall.com/lists/oss-security/2011/05/17/15"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2011-1926", "datePublished": "2011-05-23T22:00:00", "dateReserved": "2011-05-09T00:00:00", "dateUpdated": "2024-08-06T22:46:00.659Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE4D079C-54C9-436C-BEFA-2134295ABC3A", "versionEndIncluding": "2.4.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.0.17:*:*:*:*:*:*:*", "matchCriteriaId": "99D7C5A6-45E7-4BAA-B233-CCAB159C51A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.1.16:*:*:*:*:*:*:*", "matchCriteriaId": "21700E30-2236-4E51-86B9-E95447CA6048", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.1.17:*:*:*:*:*:*:*", "matchCriteriaId": "A42C288D-A01A-49B7-B940-5D02708E945D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.1.18:*:*:*:*:*:*:*", "matchCriteriaId": "CB432DB6-FFE9-42E3-B579-6AD992EDFD4F", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.2.8:*:*:*:*:*:*:*", "matchCriteriaId": "17F9BFB2-5A7C-4CA2-BB82-67D1591DD018", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.2.9:*:*:*:*:*:*:*", "matchCriteriaId": "9FCAD991-48BF-4A68-A94C-13B6168AD4E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.2.10:*:*:*:*:*:*:*", "matchCriteriaId": "641EB6FF-302A-445D-9E63-AE1AF2ADB817", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.2.11:*:*:*:*:*:*:*", "matchCriteriaId": "4916C646-E5E4-41E5-B095-D2F11E9F5991", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.2.12:*:*:*:*:*:*:*", "matchCriteriaId": "1D9D6F66-9DFF-4325-A1C2-D4B09FFE7C7C", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.2.13:*:*:*:*:*:*:*", "matchCriteriaId": "EE067B25-86BF-4607-9988-F7564478805A", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.2.13p1:*:*:*:*:*:*:*", "matchCriteriaId": "E736ECCF-2303-4910-AE53-2AA251CAD405", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "0C680C0F-355D-43D0-9D0F-C4FC7D9C4303", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "36E2F9C1-7356-4110-A07B-A7B9DD02BFB1", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "08E9F2C5-71B2-4E49-9AC1-C5C99C13323D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "1A0D47EC-F7E7-43F5-858C-9E2491142BB5", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "E65CF58D-6B31-42A8-9CE1-8FFACA8D0529", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "D308745F-8054-41D5-83C7-0F01F064FD68", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "209A797E-AD60-4A8B-9F91-D5FA441F56B3", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.7:*:*:*:*:*:*:*", "matchCriteriaId": "71641B1E-FCBA-4D22-9E1D-63557048A4AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.8:*:*:*:*:*:*:*", "matchCriteriaId": "C70C4DE0-0B02-4A9C-85A6-E33037A72679", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.9:*:*:*:*:*:*:*", "matchCriteriaId": "25696C00-BFC6-4071-9B72-45B4A96E13EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.10:*:*:*:*:*:*:*", "matchCriteriaId": "6BA183F1-A60F-4285-9938-762107FFD4DF", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.11:*:*:*:*:*:*:*", "matchCriteriaId": "439424BC-AEEC-40A2-A57C-9EC87E11EA8B", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.12:*:*:*:*:*:*:*", "matchCriteriaId": "6E86725A-ECDB-4B62-9FC7-728082201D87", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.13:*:*:*:*:*:*:*", "matchCriteriaId": "99E010BE-DA06-4FF3-8882-0DCA01F18B6F", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.14:*:*:*:*:*:*:*", "matchCriteriaId": "507FD8BF-2387-4745-A15F-FC7389D02695", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.15:*:*:*:*:*:*:*", "matchCriteriaId": "8DDF7EE8-D71E-4DC8-B5A2-53029B213F67", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.3.16:*:*:*:*:*:*:*", "matchCriteriaId": "8C92EF3C-1728-44F2-B71E-0A7FA03EDDE0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "33DA20A2-D525-4804-BD10-CE6CBB7F119D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "26BA8C3F-3909-4572-8E8B-B95F0AF728E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "5F1176CD-C6DB-45D5-91BD-194C40259A27", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "E6DCA14F-1BE5-4E7B-9B52-F1F33249AAE5", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.4.4:*:*:*:*:*:*:*", "matchCriteriaId": "0C5A89D3-AD15-4881-AC42-71459BC75685", "vulnerable": true}, {"criteria": "cpe:2.3:a:cmu:cyrus_imap_server:2.4.5:*:*:*:*:*:*:*", "matchCriteriaId": "E65F7347-D66B-4560-99FB-4DD0E3364FF4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a \"plaintext command injection\" attack, a similar issue to CVE-2011-0411."}, {"lang": "es", "value": "La implementaci\u00f3n STARTTLS en Cyrus IMAP Server anterior a v2.4.7 no restringe adecuadamente el b\u00fafer de Entrada/Salida, lo que permite ataques \"man-in-the-middle\" para insertar comandos en sesiones cifradas enviando un comando en texto claro que se procesa despu\u00e9s de TLS en su lugar, relacionado con un ataque \"inyecci\u00f3n de comandos de texto claro\", una tarea similar a CVE-2011-0411."}], "id": "CVE-2011-1926", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2011-05-23T22:55:01.490", "references": [{"source": "[email protected]", "tags": ["Patch"], "url": "http://bugzilla.cyrusimap.org/show_bug.cgi?id=3423"}, {"source": "[email protected]", "tags": ["Patch"], "url": "http://bugzilla.cyrusimap.org/show_bug.cgi?id=3424"}, {"source": "[email protected]", "tags": ["Patch"], "url": "http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162"}, {"source": "[email protected]", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061374.html"}, {"source": "[email protected]", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061415.html"}, {"source": "[email protected]", "tags": ["Patch"], "url": "http://openwall.com/lists/oss-security/2011/05/17/15"}, {"source": "[email protected]", "tags": ["Patch"], "url": "http://openwall.com/lists/oss-security/2011/05/17/2"}, {"source": "[email protected]", "url": "http://secunia.com/advisories/44670"}, {"source": "[email protected]", "url": "http://secunia.com/advisories/44876"}, {"source": "[email protected]", "url": "http://secunia.com/advisories/44913"}, {"source": "[email protected]", "url": "http://secunia.com/advisories/44928"}, {"source": "[email protected]", "url": "http://www.cyrusimap.org/docs/cyrus-imapd/2.4.7/changes.php"}, {"source": "[email protected]", "url": "http://www.debian.org/security/2011/dsa-2242"}, {"source": "[email protected]", "url": "http://www.debian.org/security/2011/dsa-2258"}, {"source": "[email protected]", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/555316"}, {"source": "[email protected]", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:100"}, {"source": "[email protected]", "url": "http://www.redhat.com/support/errata/RHSA-2011-0859.html"}, {"source": "[email protected]", "url": "http://www.securitytracker.com/id?1025625"}, {"source": "[email protected]", "tags": ["Patch"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=705288"}, {"source": "[email protected]", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/67867"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://bugzilla.cyrusimap.org/show_bug.cgi?id=3423"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://bugzilla.cyrusimap.org/show_bug.cgi?id=3424"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061374.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061415.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://openwall.com/lists/oss-security/2011/05/17/15"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://openwall.com/lists/oss-security/2011/05/17/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/44670"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/44876"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/44913"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/44928"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.cyrusimap.org/docs/cyrus-imapd/2.4.7/changes.php"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2011/dsa-2242"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2011/dsa-2258"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/555316"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:100"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.redhat.com/support/errata/RHSA-2011-0859.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1025625"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=705288"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/67867"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "[email protected]", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2011:0859", "cpe": "cpe:/o:redhat:enterprise_linux:4", "package": "cyrus-imapd-0:2.2.12-15.el4", "product_name": "Red Hat Enterprise Linux 4", "release_date": "2011-06-08T00:00:00Z"}, {"advisory": "RHSA-2011:0859", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "cyrus-imapd-0:2.3.7-7.el5_6.4", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2011-06-08T00:00:00Z"}, {"advisory": "RHSA-2011:0859", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "cyrus-imapd-0:2.3.16-6.el6_1.2", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2011-06-08T00:00:00Z"}], "bugzilla": {"description": "cyrus-imapd: STARTTLS plaintext command injection", "id": "705288", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=705288"}, "csaw": false, "cvss": {"cvss_base_score": "4.0", "cvss_scoring_vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N", "status": "verified"}, "details": ["The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a \"plaintext command injection\" attack, a similar issue to CVE-2011-0411."], "name": "CVE-2011-1926", "public_date": "2011-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2011-1926\nhttps://nvd.nist.gov/vuln/detail/CVE-2011-1926"], "threat_severity": "Moderate"}