CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2019-11356
Critical (9.8). EPSS 7.6% chance of exploitation in the next 30 days.
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
Severity
- EPSS
- 7.6% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- cyrus:imap
- debian:debian_linux
- fedoraproject:fedora
- redhat:enterprise_linux
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_tus
References
- https://access.redhat.com/errata/RHSA-2019:1771
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGO43JS7IFDNITHXOOHOP6JHRKRDIYY6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PICSZDC3UGEUZ27VXGGM6OFI67D3KKLZ/
- https://seclists.org/bugtraq/2019/Jun/9
- https://usn.ubuntu.com/4566-1/