Medium
Security advisory
Cyrus IMAP before 3.0.3 allows remote authenticated users to write to arbitrary files via a crafted (1) SYNCAPPLY, (2) SYNCGET or (3) SYNCRESTORE command.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-12843
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:13 UTC · Revision 1
Source evidence
Cyrus IMAP before 3.0.3 allows remote authenticated users to write to arbitrary files via a crafted (1) SYNCAPPLY, (2) SYNCGET or (3) SYNCRESTORE command.
osv:CVE-2017-12843
Complete source record
{
"id": "09e185502b76c6e6b108922bf2a6780487087a10640043dd0fd0874065aeca61",
"url": "https://osv.dev/vulnerability/CVE-2017-12843",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-12843",
"summary": "Cyrus IMAP before 3.0.3 allows remote authenticated users to write to arbitrary files via a crafted (1) SYNCAPPLY, (2) SYNCGET or (3) SYNCRESTORE command.",
"evidence": "osv:CVE-2017-12843",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2017-12843",
"aliases": [
"CVE-2017-12843"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/cyrusimap/cyrus-imapd",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "4fc76ac12c8375e292d501e656e5a45fb11717ea"
},
{
"fixed": "53c4137bd924b954432c6c59da7572c4c5ffa901"
},
{
"fixed": "5edadcfb83bf27107578830801817f9e6d0ad941"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "3.0.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "53c4137bd924b954432c6c59da7572c4c5ffa901"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "5edadcfb83bf27107578830801817f9e6d0ad941"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"cyrus-imapd-3.0.2",
"cyrus-imapd-3.0.1",
"cyrus-imapd-3.0.0",
"cyrus-imapd-3.0.0-rc4",
"cyrus-imapd-3.0.0-rc3",
"cyrus-imapd-3.0.0-rc2",
"cyrus-imapd-3.0.0-rc1",
"cyrus-imapd-3.0.0-beta6",
"cyrus-imapd-3.0.0-beta5",
"cyrus-imapd-3.0.0-beta4",
"cyrus-imapd-3.0.0-beta3",
"cyrus-imapd-3.0.0-beta2",
"cyrus-imapd-3.0.0-beta1",
"posttab",
"pretab",
"cyrus-imapd-2.5-snapshot-autoconf-and-automake",
"cyrus-imapd-2.4.2",
"cyrus-imapd-2.4.1",
"cyrus-imapd-2.4.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12843.json",
"vanir_signatures": [
{
"id": "CVE-2017-12843-1e9dd47e",
"digest": {
"length": 31769,
"function_hash": "219674385116949669689531931084615460613"
},
"source": "https://github.com/cyrusimap/cyrus-imapd/commit/53c4137bd924b954432c6c59da7572c4c5ffa901",
"target": {
"file": "imap/imapd.c",
"function": "cmdloop"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-12843-8460ba00",
"digest": {
"threshold": 0.9,
"line_hashes": [
"161128613383819007586463619634483843151",
"247646011980684610366732833178382271585",
"117649494215732086727697220710446517150",
"25678961534949601427643206566031952390",
"321879204090622899167320675902942221417",
"95492214099119843086933575276605995570",
"40052073482816729274258523037394326858",
"9415395520730484765121547924204674290",
"68510313081674407547137399637119008344",
"113630191945278763666264973165402073917",
"71622623123100473624602567434342980495",
"105528104037368304783568870655991787539",
"188627384149172411541344254574538229807",
"127144214496107017475562256074299742797",
"58323221536832303534964024022938136959",
"265902620788923641370796790665256047362"
]
},
"source": "https://github.com/cyrusimap/cyrus-imapd/commit/53c4137bd924b954432c6c59da7572c4c5ffa901",
"target": {
"file": "imap/imapd.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-12843-b46bc409",
"digest": {
"threshold": 0.9,
"line_hashes": [
"295552485209809559387918567516293511145",
"261979249809713859476274311045381448339",
"323157408804143212518229855208579015065",
"178275422903867361598737443910390870288",
"234979729427704345675062428659603511743",
"149575214822771283851743185746180719919",
"152905246687527392045936000061229121126",
"250028031704981336781974230307776458627",
"168522515657573590009777703836487125217",
"178988605723110663703880526640644175355",
"128924283431929782883337105278565343735"
]
},
"source": "https://github.com/cyrusimap/cyrus-imapd/commit/5edadcfb83bf27107578830801817f9e6d0ad941",
"target": {
"file": "imap/dlist.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-12843-cc44fc72",
"digest": {
"length": 578,
"function_hash": "147276937647950069138628309929940399140"
},
"source": "https://github.com/cyrusimap/cyrus-imapd/commit/5edadcfb83bf27107578830801817f9e6d0ad941",
"target": {
"file": "imap/dlist.c",
"function": "dlist_reserve_path"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:22:05Z"
}
}
],
"modified": "2026-10-20T13:22:05.929831627Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6M32R5QPCCNT57BVH3NPV5WVJFSTDP7Q/",
"https://github.com/cyrusimap/cyrus-imapd/commit/53c4137bd924b954432c6c59da7572c4c5ffa901",
"https://github.com/cyrusimap/cyrus-imapd/commit/5edadcfb83bf27107578830801817f9e6d0ad941",
"https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.3.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:26:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "26"
},
{
"last_affected": "26"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-12843",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387571,
"published_at": "2017-08-22T14:29:00.207+00:00"
}