./mail/dovecot2, Secure IMAP and POP3 server

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]

Branch: CURRENT, Version: 2.3.6, Package name: dovecot-2.3.6, Maintainer: adam

Dovecot is an open source IMAP and POP3 server for Linux/UNIX-like systems,
written with security primarily in mind. Dovecot is an excellent choice for both
small and large installations. It's fast, simple to set up, requires no special
administration and it uses very little memory.

Required to run:

Required to build:

Package options: kqueue, pam, ssl, tcpwrappers

Master sites:

SHA1: 7b939bb83bca6d2bbc932d33d5b450bd66d9d124
RMD160: 584e72ed6d8901960aa2ba48c0d3716db4222e95
Filesize: 6816.538 KB

Version history: (Expand)

CVS history: (Expand)

   2019-04-30 17:21:06 by Takahiro Kambe | Files touched by this commit (3) | Package updated
Log message:
mail/dovecot2: update to 2.3.6

Update dovecot2 and dovecot-{gssapi,ldap,mysql,pgsql,sqlite} to 2.3.6.

v2.3.6 2019-04-30  Aki Tuomi <aki.tuomi@open-xchange.com>

	* CVE-2019-11494: Submission-login crashed with signal 11 due to null
	  pointer access when authentication was aborted by disconnecting.
	* CVE-2019-11499: Submission-login crashed when authentication was
	  started over TLS secured channel and invalid authentication message
	  was sent.
	* auth: Support password grant with passdb oauth2.
	+ Use system default CAs for outbound TLS connections.
	+ Simplify array handling with new helper macros.
	+ fts_solr: Enable configuring batch_size and soft_commit features.
	- lmtp/submission: Fixed various bugs in XCLIENT handling, including a
	  hang when XCLIENT commands were sent infinitely to the remote server.
	- lmtp/submission: Forwarded multi-line replies were erroneously sent
	  as two replies to the client.
	- lib-smtp: client: Message was not guaranteed to contain CRLF
	  consistently when CHUNKING was used.
	- fts_solr: Plugin was no longer compatible with Solr 7.
	- Make it possible to disable certificate checking without
	  setting ssl_client_ca_* settings.
	- pop3c: SSL support was broken.
	- mysql: Closing connection twice lead to crash on some systems.
	- auth: Multiple oauth2 passdbs crashed auth process on deinit.
	- HTTP client connection errors infrequently triggered a segmentation
	  fault when the connection was idle and not used for a particular
	  client instance.
   2019-04-19 07:35:04 by Adam Ciarcinski | Files touched by this commit (3) | Package updated
Log message:
dovecot2: updated to

* CVE-2019-10691: Trying to login with 8bit username containing
  invalid UTF8 input causes auth process to crash if auth policy is
  enabled. This could be used rather easily to cause a DoS. Similar
  crash also happens during mail delivery when using invalid UTF8 in
  From or Subject header when OX push notification driver is used.
   2019-03-29 15:27:43 by Hauke Fath | Files touched by this commit (2)
Log message:
Security fix:

    * CVE-2019-7524: Missing input buffer size validation leads into
      arbitrary buffer overflow when reading fts or pop3 uidl header
      from Dovecot index. Exploiting this requires direct write access to
      the index files.
   2019-03-05 18:05:46 by Hauke Fath | Files touched by this commit (1) | Package updated
Log message:
Bump version after pkg update.
   2019-03-05 17:51:04 by Hauke Fath | Files touched by this commit (4) | Package updated
Log message:
Update mail/dovecot2 to v2.3.5.

From the upstream release-note:


+ Lua push notification driver: mail keywords and flags are provided
in MessageNew and MessageAppend events.
+ submission: Implement support for plugins.
+ auth: When auth_policy_log_only=yes, only log what the policy server
response would do without actually doing it.
+ auth: Always log policy server decisions with auth_verbose=yes
- v2.3.[34]: doveadm log errors: Output was missing user/session
- lda: Debug log lines could have shown slightly corrupted
- login proxy: Login processes may have crashed in various ways when
login_proxy_max_disconnect_delay was set.
- imap: Fix crash with Maildir+zlib if client disconnects during APPEND
- lmtp proxy: Fix potential assert-crash
- lmtp/submission: Fix crash when SMTP client transaction times out
- submission: Split large XCLIENT commands to 512 bytes per command,
so Postfix accepts them.
- submission: Fix crash when client sends invalid BURL command
- submission: relay backend: VRFY command: Avoid forwarding 500 and
502 replies back to client.
- lib-http: Fix potential assert-crash when DNS lookup fails
- lib-fts: Fix search query generation when one language ignores a
token (e.g. via stopwords).
   2019-02-06 02:41:28 by Takahiro Kambe | Files touched by this commit (2) | Package updated
Log message:
mail/dovecot2: update to

v2.3.4.1 2019-02-05  Aki Tuomi <aki.tuomi@open-xchange.com>

	* CVE-2019-3814: If imap/pop3/managesieve/submission client has
	  trusted certificate with missing username field
	  (ssl_cert_username_field), under some configurations Dovecot
	  mistakenly trusts the username provided via authentication instead
	  of failing.
	* ssl_cert_username_field setting was ignored with external SMTP AUTH,
	  because none of the MTAs (Postfix, Exim) currently send the
	  cert_username field. This may have allowed users with trusted
	  certificate to specify any username in the authentication. This bug
	  didn't affect Dovecot's Submission service.
   2018-12-02 05:45:00 by Amitai Schleier | Files touched by this commit (2)
Log message:
Provide declarations for kill() and SIGKILL to fix NetBSD-8 build.
   2018-12-01 12:42:41 by Amitai Schleier | Files touched by this commit (1)
Log message:
Move PKGPATH check after bsd.prefs.mk to fix circular dependency.