Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-61911 →

DEBIAN-CVE-2026-61911

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script tha...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 cyrus-imapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 cyrus-imapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 cyrus-imapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.4-1"}]}]

Références

advisory security-tracker.debian.org