CVE-2026-33606

Что произошло

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. No publicly available exploits are known.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "2.3.0",
  "lessThan": "2.3.22.2",
  "versionType": "semver"
}

{
  "status": "affected",
  "version": "3.0.0",
  "lessThan": "3.0.7",
  "versionType": "semver"
}

{
  "status": "affected",
  "version": "3.1.0",
  "lessThan": "3.1.6",
  "versionType": "semver"
}

{
  "status": "affected",
  "version": "2.3.0",
  "lessThan": "2.4.5",
  "versionType": "semver"
}

CVSS: оценки и векторы

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Источники и ссылки

{
  "cwes": [
    "cve"
  ],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-04T21:16:32.966059+00:00"
  },
  "scores": [
    "cve"
  ],
  "status": {
    "source": "cve",
    "received_at": "2026-10-28T19:52:27.427615+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-28T19:52:27.427615+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-04T21:16:32.966059+00:00"
  },
  "references": [
    "cve"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-28T19:52:27.427615+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены05.11.2026, 00:16
2. Данные обновлены04.11.2026, 00:13
3. Данные обновлены03.11.2026, 00:12
4. Данные обновлены02.11.2026, 00:10
5. Данные обновлены31.10.2026, 11:58
6. Данные обновлены29.10.2026, 12:24
7. Опубликована28.10.2026, 22:52

Личная заметка и статус

Другие CVE того же продукта