Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 17 May 2011 11:55:30 +0200
From: Jan Lieskovsky <>
CC: "Mike O'Connor" <>
Subject: CVE Request -- Cyrus-IMAP STARTTLS issue -- [was: Re: 
 pure-ftpd STARTTLS command injection / new CVE?]

Hello, Josh, Steve, vendors,

   it was reported that Cyrus-IMAP is also prone to the CVE-2011-0411 
issue (in IMAP, LMTP, NNTP, POP3, .. protocols):

Relevant upstream patch:


To my knowledge the list of CVE-2011-0411 related CVEs:

CVE-2011-0411 Postfix
CVE-2011-1430 Ipswich IMAIL
CVE-2011-1431 1431 netqmail
CVE-2011-1432 SCO Soffice Server
CVE-2011-1575 pure-ftpd

does not include Cyrus case yet (but not sure this list being
complete, so worthy of double-checking).

Could you allocate a CVE id for this?

Thank you & Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

On 04/11/2011 07:19 PM, Mike O'Connor wrote:
> :
> :
> :states that pure-ftpd is affected by the same STARTTLS
> :injection bug as postifx's CVE-2011-0411.
> :
> :Is this CVE postfix-specific or can it be used for
> :pure-ftpd as well? If needed, can someone assign a new CVE?
> It should get its own CVE assignment.  Other products with the
> same STARTTLS issue have gotten unique CVE assignments for them
> -- see CVE-2011-143[012].

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.