- Dovecot-news - dovecot.org

Pigeonhole v0.5.5 released
by Aki Tuomi 05 Mar '19

05 Mar '19

Hi! We are happy to release pigeonhole v0.5.5 for dovecot v2.3.5. Please find sources at https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.5.ta… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.5.ta… (Please note that the signing key has been changed for 0.5.5, see https://pigeonhole.dovecot.org/download.html for details.) You can find precompiled binaries at https://repo.dovecot.org/ NEWS: + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which causes messages discarded by an IMAPSieve script to be expunged immediately, rather than only being marked as "\Deleted" (which is still the default behavior). - IMAPSieve: Fix panic crash occurring when a COPY command copies messages from a virtual mailbox where the source messages originate from more than a single real mailbox. - imap4flags extension: Fix deleting all keywords. When the action resulted in all keywords being removed, no changes were actually applied. - variables extension: Fix truncation of UTF-8 variable content. The maximum size of Sieve variables was enforced by truncating the variable string content bluntly at the limit, but this does not consider UTF-8 code point boundaries. This resulted in broken UTF-8 strings. This problem also surfaced for variable modifiers, such as the ":encodeurl" modifier provided by the Sieve "enotify" extension. In that case, the resulting URI escaping could also be truncated inappropriately. - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that modify the message, stored the message a second time, rather than replacing the originally stored unmodified message. - Fix segmentation fault occurring when both the sieve_extprograms plugin (for the Sieve interpreter) and the imap_filter_sieve plugin (for IMAP) are loaded at the same time. A symbol was defined by both plugins, causing a clash when both were loaded. --- Aki Tuomi Open-Xchange Oy

1 0

Dovecot v2.3.5 released
by Aki Tuomi 05 Mar '19

05 Mar '19

Hi! We are happy to release dovecot v2.3.5. Please find sources at https://dovecot.org/releases/2.3/dovecot-2.3.5.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.5.tar.gz.sig You can find precompiled binaries at https://repo.dovecot.org/ NEWS: + Lua push notification driver: mail keywords and flags are provided in MessageNew and MessageAppend events. + submission: Implement support for plugins. + auth: When auth_policy_log_only=yes, only log what the policy server response would do without actually doing it. + auth: Always log policy server decisions with auth_verbose=yes - v2.3.[34]: doveadm log errors: Output was missing user/session - lda: Debug log lines could have shown slightly corrupted - login proxy: Login processes may have crashed in various ways when login_proxy_max_disconnect_delay was set. - imap: Fix crash with Maildir+zlib if client disconnects during APPEND - lmtp proxy: Fix potential assert-crash - lmtp/submission: Fix crash when SMTP client transaction times out - submission: Split large XCLIENT commands to 512 bytes per command, so Postfix accepts them. - submission: Fix crash when client sends invalid BURL command - submission: relay backend: VRFY command: Avoid forwarding 500 and 502 replies back to client. - lib-http: Fix potential assert-crash when DNS lookup fails - lib-fts: Fix search query generation when one language ignores a token (e.g. via stopwords). --- Aki Tuomi Open-Xchange Oy

1 0

Re: [Dovecot-news] Release notify (2.2.36.1 and 2.3.4.1)
by Aki Tuomi 05 Feb '19

05 Feb '19

1 0

Re: [Dovecot-news] Release notify (2.2.36.1 and 2.3.4.1)
by Aki Tuomi 05 Feb '19

05 Feb '19

1 0

Re: [Dovecot-news] Dovecot v2.2.36.1 released (Pigeonhole 0.4.24.1)
by Stephan Bosch 05 Feb '19

05 Feb '19

Hi, Here is the associated release for Pigeonhole: https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.24.1… https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.24.1… Binary packages included in https://repo.dovecot.org/ + imapsieve: Added imapsieve_expunge_discarded setting which causes discarded messages to be expunged immediately. - Sieve scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that modify the message, store the message a second time, rather than replacing the originally stored unmodified message. - imapsieve: Fix crash when COPYing mails from a virtual mailbox when the source messages originate from more than a single real mailbox - imap_filter_sieve plugin: Implement the missing UID FILTER command. - imap_filter_sieve plugin: Fix FILTER to work with pipelining Regards, Stephan. Op 5-2-2019 om 14:01 schreef Aki Tuomi: > https://dovecot.org/releases/2.2/dovecot-2.2.36.1.tar.gz > https://dovecot.org/releases/2.2/dovecot-2.2.36.1.tar.gz.sig > > * CVE-2019-3814: If imap/pop3/managesieve/submission client has > trusted certificate with missing username field > (ssl_cert_username_field), under some configurations Dovecot > mistakenly trusts the username provided via authentication instead > of failing. > * ssl_cert_username_field setting was ignored with external SMTP AUTH, > because none of the MTAs (Postfix, Exim) currently send the > cert_username field. This may have allowed users with trusted > certificate to specify any username in the authentication. This bug > didn't affect Dovecot's Submission service. > > - pop3_no_flag_updates=no: Don't expunge RETRed messages without QUIT > - director: Kicking a user assert-crashes if login process is very slow > - lda/lmtp: Fix assert-crash with some Sieve scripts when > mail_attachment_detection_options=add-flags-on-save > - fs-compress: Using maybe-gz assert-crashed when reading 0 sized file > - Snippet generation crashed with invalid Content-Type:multipart > > > --- > > Aki Tuomi > Open-Xchange Oy > >

1 0

Release notify (2.2.36.1 and 2.3.4.1)
by Aki Tuomi 05 Feb '19

05 Feb '19

Due to DMARC issues some people have failed to receive the latest security information, so here it is repeated for both releases: 2.3.4.1 https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz.sig <https://dovecot.org/releases/2.3/dovecot-2.3.2.tar.gz.sig> Binary packages in https://repo.dovecot.org/ * CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field (ssl_cert_username_field), under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. * ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This bug didn't affect Dovecot's Submission service. 2.2.36.1 https://dovecot.org/releases/2.2/dovecot-2.2.36.1.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.36.1.tar.gz.sig * CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field (ssl_cert_username_field), under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. * ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This bug didn't affect Dovecot's Submission service. - pop3_no_flag_updates=no: Don't expunge RETRed messages without QUIT - director: Kicking a user assert-crashes if login process is very slow - lda/lmtp: Fix assert-crash with some Sieve scripts when mail_attachment_detection_options=add-flags-on-save - fs-compress: Using maybe-gz assert-crashed when reading 0 sized file - Snippet generation crashed with invalid Content-Type:multipart

1 0

Dovecot v2.3.4.1 released
by Aki Tuomi 05 Feb '19

05 Feb '19

https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz.sig <https://dovecot.org/releases/2.3/dovecot-2.3.2.tar.gz.sig> Binary packages in https://repo.dovecot.org/ * CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field (ssl_cert_username_field), under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. * ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This bug didn't affect Dovecot's Submission service. --- Aki Tuomi Open-Xchange oy

1 0

Dovecot v2.2.36.1 released
by Aki Tuomi 05 Feb '19

05 Feb '19

https://dovecot.org/releases/2.2/dovecot-2.2.36.1.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.36.1.tar.gz.sig * CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field (ssl_cert_username_field), under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. * ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This bug didn't affect Dovecot's Submission service. - pop3_no_flag_updates=no: Don't expunge RETRed messages without QUIT - director: Kicking a user assert-crashes if login process is very slow - lda/lmtp: Fix assert-crash with some Sieve scripts when mail_attachment_detection_options=add-flags-on-save - fs-compress: Using maybe-gz assert-crashed when reading 0 sized file - Snippet generation crashed with invalid Content-Type:multipart --- Aki Tuomi Open-Xchange Oy

1 0

v2.3.4 released
by Timo Sirainen 23 Nov '18

23 Nov '18

https://dovecot.org/releases/2.3/dovecot-2.3.4.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.4.tar.gz.sig Binary packages in https://repo.dovecot.org/ * The default postmaster_address is now "postmaster@<user domain or server hostname>". If username contains the @domain part, that's used. If not, then the server's hostname is used. * "doveadm stats dump" now returns two decimals for the "avg" field. + Added push notification driver that uses a Lua script + Added new SQL, DNS and connection events. See https://wiki2.dovecot.org/Events + Added "doveadm mailbox cache purge" command. + Added events API support for Lua scripts + doveadm force-resync -f parameter performs "index fsck" while opening the index. This may be useful to fix some types of broken index files. This may become the default behavior in a later version. - director: Kicking a user crashes if login process is very slow - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages unless QUIT is sent. - auth: Fix crypt() segfault with glibc-2.28+ - imap: Running UID FILTER script with errors assert-crashes - dsync, pop3-migration: POP3 UIDLs weren't added to dovecot.index.cache while mails were saved. - dict clients may have been using 100% CPU while waiting for dict server to finish commands. - doveadm user: Fixed user listing via HTTP API - All levels of Cassandra log messages were logged as Dovecot errors. - http/smtp client may have crashed after SSL handshake - Lua auth converted strings that looked like numbers into numbers.

2 1

Released Pigeonhole v0.5.3 for Dovecot v2.3.3.
by Stephan Bosch 01 Oct '18

01 Oct '18

Hello Dovecot users, Here's the Pigeonhole release that goes with Dovecot v2.3.3. Only two insignificant memory leak fixes were added since the release candidate (not mentioned in the changelog). Changelog v0.5.3: - Fix assertion panic occurring when managesieve service fails to open INBOX while saving a Sieve script. This was caused by a lack of cleanup after failure. - Fix specific messages causing an assert panic with actions that compose a reply (e.g. vacation). With some rather weird input from the original message, the header folding algorithm (as used for composing the References header for the reply) got confused, causing the panic. - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command parsing. After finishing reading the Sieve script, the command parsing sometimes didn't continue with the search arguments. This is a time- critical bug that likely only occurs when the Sieve script is sent in the next TCP frame. The release is available as follows: https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.3.ta… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.3.ta… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0