Cyrus IMAP 3.4.2 Release Notes — Cyrus IMAP 3.10.1 documentation

# Cyrus IMAP 3.4.2 Release Notes

Download from GitHub:

> - https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.2/cyrus-imapd-3.4.2.tar.gz

> - https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.2/cyrus-imapd-3.4.2.tar.gz.sig

## Changes since 3.4.1

### Security fixes:

- Fixed CVE-2021-33582: Certain user inputs are used as hash table keys during processing. A poorly chosen string hashing algorithm meant that the user could control which bucket their data was stored in, allowing a malicious user to direct many inputs to a single bucket. Each subsequent insertion to the same bucket requires a strcmp of every other entry in it. At tens of thousands of entries, each new insertion could keep the CPU busy in a strcmp loop for minutes.

  The string hashing algorithm has been replaced with a better one, and now also uses a random seed per hash table, so malicious inputs cannot be precomputed.

  Discovered by Matthew Horsfall, Fastmail

### Build changes

- Fixed Issue #3527: build problems when --without-sieve configured

### Bug fixes

- Fixed: missing CY namespace in some DAV responses

- Fixed: don't allow JMAP uploads if the user does not have r/w access to any mailbox/calendar/addressbook

- Fixed: Email/query sometimes chose the wrong search algorithm

- Fixed Issue #3488: LMTP delivery to shared mailboxes was broken

- Fixed Issue #3528: 'lookup' ACL alone was not allowing IMAP LIST

- Fixed: RTF message bodies were treated as plain text in search snippets