Log message:
dovecot2: updated to 2.3.21.1

v2.3.21.1

- CVE-2024-23184: A large number of address headers in email resulted
  in excessive CPU usage.
- CVE-2024-23185: Abnormally large email headers are now truncated or
  discarded, with a limit of 10MB on a single header and 50MB for all
  the headers of all the parts of an email.
- oauth2: Dovecot would send client_id and client_secret as POST parameters
  to introspection server. These need to be optionally in Basic auth
  instead as required by OIDC specification.
- oauth2: JWT key type check was too strict.
- oauth2: JWT token audience was not validated against client_id as
  required by OIDC specification.
- oauth2: XOAUTH2 and OAUTHBEARER mechanisms were not giving out
  protocol specific error message on all errors. This broke OIDC discovery.
- oauth2: JWT aud validation was not performed if aud was missing
  from token, but was configured on Dovecot.

Log message:
*: bump for openssl 3

Log message:
mail/dovecot2: update to 2.3.9.3

Update dovecot2 to 2.3.9.3, security release.

v2.3.9.3 2019-02-12  Aki Tuomi <aki.tuomi@open-xchange.com>

	* CVE-2020-7046: Truncated UTF-8 can be used to DoS
	  submission-login and lmtp processes.
	* CVE-2020-7957: Specially crafted mail can crash snippet generation.

Log message:
*: Recursive revision bump for openssl 1.1.1.

Log message:
dovecot2: updated to 2.3.4

2.3.4:
 * The default postmaster_address is now "postmaster@<user domain or
   server hostname>". If username contains the @domain part, that's
   used. If not, then the server's hostname is used.
 * "doveadm stats dump" now returns two decimals for the \ 
"avg" field.

 + Added push notification driver that uses a Lua script
 + Added new SQL, DNS and connection events.
   See https://wiki2.dovecot.org/Events
 + Added "doveadm mailbox cache purge" command.
 + Added events API support for Lua scripts
 + doveadm force-resync -f parameter performs "index fsck" while opening
   the index. This may be useful to fix some types of broken index files.
   This may become the default behavior in a later version.
 - director: Kicking a user crashes if login process is very slow
 - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
   unless QUIT is sent.
 - auth: Fix crypt() segfault with glibc-2.28+
 - imap: Running UID FILTER script with errors assert-crashes
 - dsync, pop3-migration: POP3 UIDLs weren't added to
   dovecot.index.cache while mails were saved.
 - dict clients may have been using 100% CPU while waiting for dict
   server to finish commands.
 - doveadm user: Fixed user listing via HTTP API
 - All levels of Cassandra log messages were logged as Dovecot errors.
 - http/smtp client may have crashed after SSL handshake
 - Lua auth converted strings that looked like numbers into numbers.

Log message:
dovecot2: updated to 2.3.3

2.3.3:
* doveconf hides more secrets now in the default output.
* ssl_dh setting is no longer enforced at startup. If it's not set and
  non-ECC DH key exchange happens, error is logged and client is
  disconnected.

+ Added log_debug=<filter> setting.
+ Added log_core_filter=<log filter> setting.
+ quota-clone: Write to dict asynchronously
+ --enable-hardening attempts to use retpoline Spectre 2 mitigations
+ lmtp proxy: Support source_ip passdb extra field.
+ doveadm stats dump: Support more fields and output stddev by default.
+ push-notification: Add SSL support for OX backend.
- NUL bytes in mail headers can cause truncated replies when fetched.
- director: Conflicting host up/down state changes may in some rare
  situations ended up in a loop of two directors constantly overwriting
  each others' changes.
- director: Fix hang/crash when multiple doveadm commands are being
  handled concurrently.
- director: Fix assert-crash if doveadm disconnects too early
- virtual plugin: Some searches used 100% CPU for many seconds
- dsync assert-crashed with acl plugin in some situations.
- mail_attachment_detection_options=add-flags-on-save assert-crashed
  with some specific Sieve scripts.
- Mail snippet generation crashed with mails containing invalid
  Content-Type:multipart header.
- Log prefix ordering was different for some log lines.
- quota: With noenforcing option current quota usage wasn't updated.
- auth: Kerberos authentication against Samba assert-crashed.
- stats clients were unnecessarily chatty with the stats server.
- imapc: Fixed various assert-crashes when reconnecting to server.
- lmtp, submission: Fix potential crash if client disconnects while
  handling a command.
- quota: Fixed compiling with glibc-2.26 / support libtirpc.
- fts-solr: Empty search values resulted in 400 Bad Request errors
- fts-solr: default_ns parameter couldn't be used
- submission server crashed if relay server returned over 7 lines in
  a reply (e.g. to EHLO)

Log message:
Update mail/dovecot2* to 2.3.0.

Some of the larger changes:

* Various setting changes, see https://wiki2.dovecot.org/Upgrading/2.3
* Logging rewrite started: Logging is now based on hierarchical events.
  This makes it possible to do various things, like: 1) giving
  consistent log prefixes, 2) enabling debug logging with finer
  granularity, 3) provide logs in more machine readable formats
  (e.g. json). Everything isn't finished yet, especially a lot of the
  old logging code still needs to be translated to the new way.
* Statistics rewrite started: Stats are now based on (log) events.
  It's possible to gather statistics about any event that is logged.
  See http://wiki2.dovecot.org/Statistics for details
* ssl_dh setting replaces the old generated ssl-parameters.dat
* IMAP: When BINARY FETCH finds a broken mails, send [PARSE] error
  instead of [UNKNOWNCTE]
* Linux: core dumping via PR_SET_DUMPABLE is no longer enabled by
  default due to potential security reasons (found by cPanel Security
  Team).
+ Added support for SMTP submission proxy server, which includes
  support for BURL and CHUNKING extension.
+ LMTP rewrite. Supports now CHUNKING extension and mixing of
  local/proxy recipients.
+ auth: Support libsodium to add support for ARGON2I and ARGON2ID
  password schemes.
+ auth: Support BLF-CRYPT password scheme in all platforms
+ auth: Added LUA scripting support for passdb/userdb.
  See https://wiki2.dovecot.org/AuthDatabase/Lua
- Input streams are more reliable now when there are errors or when
  the maximum buffer size is reached. Previously in some situations
  this could have caused Dovecot to try to read already freed memory.
- Output streams weren't previously handling failures when writing a
  trailer at the end of the stream. This mainly affected encrypt and
  zlib compress ostreams, which could have silently written truncated
  files if the last write happened to fail (which shouldn't normally
  have ever happened).
- virtual plugin: Fixed panic when fetching mails from virtual
  mailboxes with IMAP BINARY extension.
- doveadm-server: Fix potential hangs with SSL connections
- doveadm proxy: Reading commands' output from v2.2.33+ servers could
  have caused the output to be corrupted or caused a crash.
- Many other smaller fixes