A vulnerability has been identified and fixed in cyrus-imapd:

The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does
not properly restrict I/O buffering, which allows man-in-the-middle
attackers to insert commands into encrypted sessions by sending a
cleartext command that is processed after TLS is in place, related to
a plaintext command injection attack, a similar issue to CVE-2011-0411
(CVE-2011-1926).

Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

The updated packages have been patched to correct this issue.