Log message:
*: Recursive revbump from textproc/icu-68.1

Log message:
mail/dovocot2: update to 2.3.11.3

Update dovecot2 and related packages to 2.3.11.3.

v2.3.11.3 2020-07-29	Aki Tuomi <aki.tuomi@open-xchange.com>

	- pop3-login: Login didn't handle commands in multiple IP packets properly.
	  This mainly affected large XCLIENT commands or a large SASL initial
	  response parameter in the AUTH command.
	- pop3: pop3_deleted_flag setting was broken, causing:
	  Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
	  assertion failed: (range[count-1].seq2 <= max_seq)

v2.3.11.2 2020-07-13	Aki Tuomi <aki.tuomi@open-xchange.com>

	- auth: Lua passdb/userdb leaks stack elements per call, eventually
	  causing the stack to become too deep and crashing the auth or
	  auth-worker process.
	- lib-mail: v2.3.11 regression: MIME parts not returned correctly by
	  Dovecot MIME parser.
	- pop3-login: Login would fail with "Input buffer full" if the initial
	  response for SASL was too long.

v2.3.11 2020-06-17  Aki Tuomi <aki.tuomi@open-xchange.com>

	* CVE-2020-12100: Parsing mails with a large number of MIME parts could
	  have resulted in excessive CPU usage or a crash due to running out of
	  stack memory.
	* CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
	  message buffer size, which leads to reading past allocation which can
	  lead to crash.
	* CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
	  zero-length message, which leads to assert-crash later on.
	* Events: Fix inconsistency in events. See event documentation in
	  https://doc.dovecot.org.
	* imap_command_finished event's cmd_name field now contains "unknown"
	  for unknown commands. A new "cmd_input_name" field contains the
	  command name exactly as it was sent.
	* lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
	  Note that these settings are mainly intended for testing and usually
	  shouldn't be changed.
	* events: Renamed "index" event category to "mail-index".
	* events: service:<name> category is now using the name from
	  configuration file.
	* dns-client: service dns_client was renamed to dns-client.
	* log: Prefixes generally use the service name from configuration file.
	  For example dict-async service will now use
	  "dict-async(pid): " log prefix instead of "dict(pid): "
	* *-login: Changed logging done by proxying to use a consistent prefix
	  containing the IP address and port.
	* *-login: Changed disconnection log messages to be slightly clearer.
	+ dict: Add events for dictionaries.
	+ lib-index: Finish logging with events.
	+ oauth2: Support local validation of JWT tokens.
	+ stats: Add support for dynamic histograms and grouping. See
	  https://doc.dovecot.org/configuration_manual/stats/.
	+ imap: Implement RFC 8514: IMAP SAVEDATE
	+ lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
	  folder) adds a lot of data to dovecot.index.cache file, commit those
	  changes periodically to make them visible to other concurrent sessions
	  as well.
	+ stats: Add OpenMetrics exporter for statistics. See
	  https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
	+ stats: Support disabling stats-writer socket by setting
	  stats_writer_socket_path="".
	- auth-worker: Process keeps slowly increasing its memory usage and
	  eventually dies with "out of memory" due to reaching vsz_limit.
	- auth: Prevent potential timing attacks in authentication secret
	  comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
	- auth: Several auth-mechanisms allowed input to be truncated by NUL
	  which can potentially lead to unintentional issues or even successful
	  logins which should have failed.
	- auth: When auth policy returned a delay, auth_request_finished event
	  had policy_result=ok field instead of policy_result=delayed.
	- auth: auth process crash when auth_policy_server_url is set to an
	  invalid URL.
	- dict-ldap: Crash occurs if var_expand template expansion fails.
	- dict: If dict client disconnected while iteration was still running,
	  dict process could have started using 100% CPU, although it was still
	  handling clients.
	- doveadm: Running doveadm commands via proxying may hang, especially
	  when doveadm is printing a lot of output.
	- imap: "MOVE * destfolder" goes to a loop copying the last mail to the
	  destination until the imap process dies due to running out of memory.
	- imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
	  loop.
	- imap: SEARCH doesn't support $.
	- lib-compress: Buffer over-read in zlib stream read.
	- lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
	  process.
	- lib-index: Fixed several bugs in dovecot.index.cache handling that
	  could have caused cached data to be lost.
	- lib-index: Writing to >=1 GB dovecot.index.cache files may cause
	  assert-crashes:
	  Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
	  assertion failed: (offset < 0x40000000)
	- lib-ssl-iostream: Fix buggy OpenSSL error handling without
	  assert-crashing. If there is no error available, log it as an error
	  instead of crashing:
	  Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
	  assertion failed: (errno != 0)
	- lib-ssl-iostream: ssl_key_password setting did not work.
	- submission: A segfault crash may occur when the client or server
	  disconnects while a non-transaction command like NOOP or VRFY is still
	  being processed.
	- virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
	  Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
	  (copy_ctx->copy_count == seq_range_count(&copy_ctx->saved_uids))

Log message:
Revbump for icu

Log message:
mail/dovecot2: update to 2.3.10.1

Update dovecot2 to 2.3.10.1.

v2.3.10.1  2020-05-18  Aki Tuomi <aki.tuomi@open-xchange.com>

- CVE-2020-10957: lmtp/submission: A client can crash the server by
  sending a NOOP command with an invalid string parameter. This occurs
  particularly for a parameter that doesn't start with a double quote.
  This applies to all SMTP services, including submission-login, which
  makes it possible to crash the submission service without
  authentication.
- CVE-2020-10958: lmtp/submission: Sending many invalid or unknown
  commands can cause the server to access freed memory, which can lead
  to a server crash. This happens when the server closes the connection
  with a "421 Too many invalid commands" error. The bad command limit
  depends on the service (lmtp or submission) and varies between 10 to
  20 bad commands.
- CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
  address that has the empty quoted string as local-part causes the lmtp
  service to crash.

Log message:
Recursive revision bump after textproc/icu update

Log message:
dovecot2: updated to 2.3.5.2

v2.3.5.2
* CVE-2019-10691: Trying to login with 8bit username containing
  invalid UTF8 input causes auth process to crash if auth policy is
  enabled. This could be used rather easily to cause a DoS. Similar
  crash also happens during mail delivery when using invalid UTF8 in
  From or Subject header when OX push notification driver is used.

Log message:
Recursive revbump from textproc/icu

Log message:
mail/dovecot2-sqlite: reset PKGREVISION

Reset PKGREVISION with update to 2.3.4.1.

Log message:
revbump after updating textproc/icu

Log message:
dovecot2: updated to 2.3.4

2.3.4:
 * The default postmaster_address is now "postmaster@<user domain or
   server hostname>". If username contains the @domain part, that's
   used. If not, then the server's hostname is used.
 * "doveadm stats dump" now returns two decimals for the \ 
"avg" field.

 + Added push notification driver that uses a Lua script
 + Added new SQL, DNS and connection events.
   See https://wiki2.dovecot.org/Events
 + Added "doveadm mailbox cache purge" command.
 + Added events API support for Lua scripts
 + doveadm force-resync -f parameter performs "index fsck" while opening
   the index. This may be useful to fix some types of broken index files.
   This may become the default behavior in a later version.
 - director: Kicking a user crashes if login process is very slow
 - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
   unless QUIT is sent.
 - auth: Fix crypt() segfault with glibc-2.28+
 - imap: Running UID FILTER script with errors assert-crashes
 - dsync, pop3-migration: POP3 UIDLs weren't added to
   dovecot.index.cache while mails were saved.
 - dict clients may have been using 100% CPU while waiting for dict
   server to finish commands.
 - doveadm user: Fixed user listing via HTTP API
 - All levels of Cassandra log messages were logged as Dovecot errors.
 - http/smtp client may have crashed after SSL handshake
 - Lua auth converted strings that looked like numbers into numbers.