./mail/dovecot2, Secure IMAP and POP3 server

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 2.3.1, Package name: dovecot-2.3.1, Maintainer: adam

Dovecot is an open source IMAP and POP3 server for Linux/UNIX-like systems,
written with security primarily in mind. Dovecot is an excellent choice for both
small and large installations. It's fast, simple to set up, requires no special
administration and it uses very little memory.


Required to run:
[archivers/lz4]

Required to build:
[pkgtools/cwrappers]

Package options: kqueue, pam, ssl, tcpwrappers

Master sites:

SHA1: 4f098f4c1a63a714ec428292dce20f7ae5cc8ce1
RMD160: 0728aee3bdaf66cdbb488dc59a1e1a5268b6db36
Filesize: 6545.985 KB

Version history: (Expand)


CVS history: (Expand)


   2018-05-22 22:49:45 by =?UTF-8?B?RnLDqWTDqXJpYyBGYXViZXJ0ZWF1?= | Files touched by this commit (6) | Package updated
Log message:
dovecot2: update to 2.3.1

Changes:
* Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
* API CHANGE: array_idx_modifiable will no longer allocate space
 - Particularly affects how you should check MODULE_CONTEXT result, or use \ 
REQUIRE_MODULE_CONTEXT.

+ mail_attachment_detection_options setting controls when
  $HasAttachment and $HasNoAttachment keywords are set for mails.
+ imap: Support fetching body snippets using FETCH (SNIPPET) or
  (SNIPPET (LAZY=FUZZY))
+ fs-compress: Automatically detect whether input is compressed or not.
  Prefix the compression algorithm with "maybe-" to enable the
  detection, for example: "compress:maybe-gz:6:..."
+ Added settings to change dovecot.index* files' optimization behavior.
  See https://wiki2.dovecot.org/IndexFiles#Settings
+ Auth cache can now utilize auth workers to do password hash
  verification by setting auth_cache_verify_password_with_worker=yes.
+ Added charset_alias plugin. See
  https://wiki2.dovecot.org/Plugins/CharsetAlias
+ imap_logout_format and pop3_logout_format settings now support all of the \ 
generic variables (e.g. %{rip}, %{session}, etc.)
   2018-04-18 00:29:53 by Thomas Klausner | Files touched by this commit (286)
Log message:
Add p11-kit to gnutls/bl3.mk and bump dependencies.
   2018-03-01 12:13:14 by Takahiro Kambe | Files touched by this commit (3) | Package updated
Log message:
mail/dovecot2: update to 2.3.0.1

Small patch release to fix the worst bugs in v2.3.0. v2.3.1 is coming in about a \ 
month with a lot more changes.

 * CVE-2017-15130: TLS SNI config lookups may lead to excessive
   memory usage, causing imap-login/pop3-login VSZ limit to be reached
   and the process restarted. This happens only if Dovecot config has
   local_name { } or local { } configuration blocks and attacker uses
   randomly generated SNI servernames.
 * CVE-2017-14461: Parsing invalid email addresses may cause a crash or
   leak memory contents to attacker. For example, these memory contents
   might contain parts of an email from another user if the same imap
   process is reused for multiple users. First discovered by Aleksandar
   Nikolic of Cisco Talos. Independently also discovered by "flxflndy"
   via HackerOne.
 * CVE-2017-15132: Aborted SASL authentication leaks memory in login
   process.
 * Linux: Core dumping is no longer enabled by default via
   PR_SET_DUMPABLE, because this may allow attackers to bypass
   chroot/group restrictions. Found by cPanel Security Team. Nowadays
   core dumps can be safely enabled by using "sysctl -w
   fs.suid_dumpable=2". If the old behaviour is wanted, it can still be
   enabled by setting:
   import_environment=$import_environment PR_SET_DUMPABLE=1
 - imap-login with SSL/TLS connections may end up in infinite loop
   2018-01-24 16:16:49 by Jonathan Perkin | Files touched by this commit (1)
Log message:
dovecot2: Don't automatically add compiler security features.
   2018-01-08 14:03:15 by Filip Hajny | Files touched by this commit (1)
Log message:
mail/dovecot2: bump ABI dependency to 2.3.0 for dovecot2-pigeonhole.
   2018-01-04 01:22:02 by Maya Rashish | Files touched by this commit (2)
Log message:
dovecot2: remove now redundant patch.

Heads up by jzu, thanks.
   2018-01-02 16:52:44 by Filip Hajny | Files touched by this commit (10) | Package updated
Log message:
Update mail/dovecot2* to 2.3.0.

Some of the larger changes:

* Various setting changes, see https://wiki2.dovecot.org/Upgrading/2.3
* Logging rewrite started: Logging is now based on hierarchical events.
  This makes it possible to do various things, like: 1) giving
  consistent log prefixes, 2) enabling debug logging with finer
  granularity, 3) provide logs in more machine readable formats
  (e.g. json). Everything isn't finished yet, especially a lot of the
  old logging code still needs to be translated to the new way.
* Statistics rewrite started: Stats are now based on (log) events.
  It's possible to gather statistics about any event that is logged.
  See http://wiki2.dovecot.org/Statistics for details
* ssl_dh setting replaces the old generated ssl-parameters.dat
* IMAP: When BINARY FETCH finds a broken mails, send [PARSE] error
  instead of [UNKNOWNCTE]
* Linux: core dumping via PR_SET_DUMPABLE is no longer enabled by
  default due to potential security reasons (found by cPanel Security
  Team).
+ Added support for SMTP submission proxy server, which includes
  support for BURL and CHUNKING extension.
+ LMTP rewrite. Supports now CHUNKING extension and mixing of
  local/proxy recipients.
+ auth: Support libsodium to add support for ARGON2I and ARGON2ID
  password schemes.
+ auth: Support BLF-CRYPT password scheme in all platforms
+ auth: Added LUA scripting support for passdb/userdb.
  See https://wiki2.dovecot.org/AuthDatabase/Lua
- Input streams are more reliable now when there are errors or when
  the maximum buffer size is reached. Previously in some situations
  this could have caused Dovecot to try to read already freed memory.
- Output streams weren't previously handling failures when writing a
  trailer at the end of the stream. This mainly affected encrypt and
  zlib compress ostreams, which could have silently written truncated
  files if the last write happened to fail (which shouldn't normally
  have ever happened).
- virtual plugin: Fixed panic when fetching mails from virtual
  mailboxes with IMAP BINARY extension.
- doveadm-server: Fix potential hangs with SSL connections
- doveadm proxy: Reading commands' output from v2.2.33+ servers could
  have caused the output to be corrupted or caused a crash.
- Many other smaller fixes
   2017-10-22 09:07:34 by Adam Ciarcinski | Files touched by this commit (2) | Package updated
Log message:
dovecot2: update to 2.2.33.2

2.2.33.2:
- doveadm: Fix crash in proxying (or dsync replication) if remote is
  running older than v2.2.33
- auth: Fix memory leak in %{ldap_dn}
- dict-sql: Fix data types to work correctly with Cassandra