CVE-2019-19783: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days.

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.

Affected products

• Canonical Ubuntu Linux: version 18.04 only
• Cyrus Imap: from 2.5.0, before 2.5.15 (fixed in 2.5.15); from 3.0.0, before 3.0.13 (fixed in 3.0.13); from 3.1.0, before 3.1.8 (fixed in 3.1.8)
• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 30 only; version 31 only

Published 2019-12-16. Last modified 2026-06-17.