- Dovecot-news - dovecot.org

v2.2.31 released
by Timo Sirainen 26 Jun '17

26 Jun '17

https://dovecot.org/releases/2.2/dovecot-2.2.31.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.31.tar.gz.sig This should be a great and stable release for the summer :) v2.2.32 is planned for the end of August. Hopefully soon afterwards we can get back to v2.3. * LMTP: Removed "(Dovecot)" from added Received headers. Some installations want to hide it, and there's not really any good reason for anyone to have it. + Add ssl_alt_cert and ssl_alt_key settings to add support for having both RSA and ECDSA certificates. + dsync/imapc, pop3-migration plugin: Strip trailing whitespace from headers when matching mails. This helps with migrations from Zimbra. + acl: Add acl_globals_only setting to disable looking up per-mailbox dovecot-acl files. + Parse invalid message addresses better. This mainly affects the generated IMAP ENVELOPE replies. - v2.2.30 wasn't fixing corrupted dovecot.index.cache files properly. It could have deleted wrong mail's cache or assert-crashed. - v2.2.30 mail-crypt-acl plugin was assert-crashing - v2.2.30 welcome plugin wasn't working - Various fixes to handling mailbox listing. Especially related to handling nonexistent autocreated/autosubscribed mailboxes and ACLs. - Global ACL file was parsed as if it was local ACL file. This caused some of the ACL rule interactions to not work exactly as intended. - auth: forward_* fields didn't work properly: Only the first forward field was working, and only if the first passdb lookup succeeded. - Using mail_sort_max_read_count sometimes caused "Broken sort-* indexes, resetting" errors. - Using mail_sort_max_read_count may have caused very high CPU usage. - Message address parsing could have crashed on invalid input. - imapc_features=fetch-headers wasn't always working correctly and caused the full header to be fetched. - imapc: Various bugfixes related to connection failure handling. - quota=imapc sent unnecessary FETCH RFC822.SIZE to server when expunging mails. - quota=count: quota_warning = -storage=.. was never executed - quota=count: Add support for "ns" parameter - dsync: Fix incremental syncing for mails that don't have Date or Message-ID headers. - imap: Fix hang when client sends pipelined SEARCH + EXPUNGE/CLOSE/LOGOUT. - oauth2: Token validation didn't accept empty server responses. - imap: NOTIFY command has been almost completely broken since the beginning. I guess nobody has been trying to use it.

1 0

Released Pigeonhole v0.4.19.rc1 for Dovecot v2.2.31.rc1.
by Stephan Bosch 22 Jun '17

22 Jun '17

Hello Dovecot users, This small release is mainly about adjusting to changes in the Dovecot API. There is one significant fix. Changelog v0.4.19: * This release adjusts Pigeonhole to several changes in the Dovecot API, making it depend on Dovecot v2.2.31. Previous versions of Pigeonhole will produce compile warnings with the recent Dovecot releases (but still work ok). - Fixed bug in handling of implicit keep in some cases. Implicit side-effects, such as assigned flags, were not always applied correctly. This is in essence a very old bug, but it was exposed by recent changes. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/rc/dovecot-2.2-pigeonhole-0.4.19… http://pigeonhole.dovecot.org/releases/2.2/rc/dovecot-2.2-pigeonhole-0.4.19… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this release candidate and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v2.2.31 release candidate released
by Timo Sirainen 20 Jun '17

20 Jun '17

https://dovecot.org/releases/2.2/rc/dovecot-2.2.31.rc1.tar.gz https://dovecot.org/releases/2.2/rc/dovecot-2.2.31.rc1.tar.gz.sig Unless new bugs are found, this will be the final v2.2.31 release, which will be released on Monday. * LMTP: Removed "(Dovecot)" from added Received headers. Some installations want to hide it, and there's not really any good reason for anyone to have it. + Add ssl_alt_cert and ssl_alt_key settings to add support for having both RSA and ECDSA certificates. + pop3-migration plugin: Strip trailing whitespace from headers when matching mails between IMAP and POP3. This helps with migrations from Zimbra. + acl: Add acl_globals_only setting to disable looking up per-mailbox dovecot-acl files. + Parse invalid message addresses better. This mainly affects the generated IMAP ENVELOPE replies. - v2.2.30 wasn't fixing corrupted dovecot.index.cache files properly. It could have deleted wrong mail's cache or assert-crashed. - v2.2.30 mail-crypt-acl plugin was assert-crashing - v2.2.30 welcome plugin wasn't working - Various fixes to handling mailbox listing. Especially related to handling nonexistent autocreated/autosubscribed mailboxes and ACLs. - Global ACL file was parsed as if it was local ACL file. This caused some of the ACL rule interactions to not work exactly as intended. - auth: forward_* fields didn't work properly: Only the first forward field was working, and only if the first passdb lookup succeeded. - Using mail_sort_max_read_count sometimes caused "Broken sort-* indexes, resetting" errors. - Using mail_sort_max_read_count may have caused very high CPU usage. - Message address parsing could have crashed on invalid input. - imapc_features=fetch-headers wasn't always working correctly and caused the full header to be fetched. - imapc: Various bugfixes related to connection failure handling. - quota=imapc sent unnecessary FETCH RFC822.SIZE to server when expunging mails. - quota=count: quota_warning = -storage=.. was never executed - quota=count: Add support for "ns" parameter - dsync: Fix incremental syncing for mails that don't have Date or Message-ID headers. - imap: Fix hang when client sends pipelined SEARCH + EXPUNGE/CLOSE/LOGOUT. - oauth2: Token validation didn't accept empty server responses. - imap: NOTIFY command has been almost completely broken since the beginning. I guess nobody has been trying to use it.

1 0

v2.2.30.2 released
by Timo Sirainen 06 Jun '17

06 Jun '17

https://dovecot.org/releases/2.2/dovecot-2.2.30.2.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.30.2.tar.gz.sig Hopefully the last 2.2.30.x.. - auth: Multiple failed authentications within short time caused crashes - push-notification: OX driver crashed at deinit

1 0

v2.2.30.1 released
by Timo Sirainen 31 May '17

31 May '17

https://dovecot.org/releases/2.2/dovecot-2.2.30.1.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.30.1.tar.gz.sig Due to some release process changes I didn't notice that one important bugfix wasn't included in the v2.2.30 release branch before I made the release. So fixing it here with v2.2.30.1. Also included another less important fix. - quota_warning scripts weren't working in v2.2.30 - vpopmail still wasn't compiling Also I guess should mention that in v2.2.30+ the "script" service's protocol changed to a new version. If anyone had written their own script services (not using the included "script" binary) they would need some changes. I haven't heard of anyone having done that though.

1 0

v2.2.30 released
by Timo Sirainen 30 May '17

30 May '17

https://dovecot.org/releases/2.2/dovecot-2.2.30.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.30.tar.gz.sig * auth: Use timing safe comparisons for everything related to passwords. It's unlikely that these could have been used for practical attacks, especially because Dovecot delays and flushes all failed authentications in 2 second intervals. Also it could have worked only when passwords were stored in plaintext in the passdb. * master process sends SIGQUIT to all running children at shutdown, which instructs them to close all the socket listeners immediately. This way restarting Dovecot should no longer fail due to some processes keeping the listeners open for a long time. + auth: Add passdb { mechanisms=none } to match separate passdb lookup + auth: Add passdb { username_filter } to use passdb only if user matches the filter. See https://wiki2.dovecot.org/PasswordDatabase + dsync: Add dsync_commit_msgs_interval setting. It attempts to commit the transaction after saving this many new messages. Because of the way dsync works, it may not always be possible if mails are copied or UIDs need to change. + imapc: Support imapc_features=search without ESEARCH extension. + imapc: Add imapc_features=fetch-bodystructure to pass through remote server's FETCH BODY and BODYSTRUCTURE. + imapc: Add quota=imapc backend to use GETQUOTA/GETQUOTAROOT on the remote server. + passdb imap: Add allow_invalid_cert and ssl_ca_file parameters. + If dovecot.index.cache corruption is detected, reset only the one corrupted mail instead of the whole file. + doveadm mailbox status: Add "firstsaved" field. + director_flush_socket: Add old host's up/down and vhost count as parameters - More fixes to automatically fix corruption in dovecot.list.index - dsync-server: Fix support for dsync_features=empty-header-workaround - imapc: Various bugfixes, including infinite loops on some errors - IMAP NOTIFY wasn't working for non-INBOX if IMAP client hadn't enabled modseq tracking via CONDSTORE/QRESYNC. - fts-lucene: Fix it to work again with mbox format - Some internal error messages may have contained garbage in v2.2.29 - mail-crypt: Re-encrypt when copying/moving mails and per-mailbox keys are used. Otherwise the copied mails can't be opened. - vpopmail: Fix compiling

1 0

v2.2.30 release candidate released
by Timo Sirainen 24 May '17

24 May '17

https://dovecot.org/releases/2.2/rc/dovecot-2.2.30.rc1.tar.gz https://dovecot.org/releases/2.2/rc/dovecot-2.2.30.rc1.tar.gz.sig There are a couple of changes still coming, but now would be a good time to make sure anything unexpected hasn't broken. The final release should be out early next week. * auth: Use timing safe comparisons for everything related to passwords. It's unlikely that these could have been used for practical attacks, especially because Dovecot delays and flushes all failed authentications in 2 second intervals. Also it could have worked only when passwords were stored in plaintext in the passdb. * master process sends SIGQUIT to all running children at shutdown, which instructs them to close all the socket listeners immediately. This way restarting Dovecot should no longer fail due to some processes keeping the listeners open for a long time. + auth: Add passdb { mechanisms=none } to match separate passdb lookup + auth: Add passdb { username_filter } to use passdb only if user matches the filter. See https://wiki2.dovecot.org/PasswordDatabase + dsync: Add dsync_commit_msgs_interval setting. It attempts to commit the transaction after saving this many new messages. Because of the way dsync works, it may not always be possible if mails are copied or UIDs need to change. + imapc: Support imapc_features=search without ESEARCH extension. + imapc: Add imapc_features=fetch-bodystructure to pass through remote server's FETCH BODY and BODYSTRUCTURE. + imapc: Add quota=imapc backend to use GETQUOTA/GETQUOTAROOT on the remote server. + passdb imap: Add allow_invalid_cert and ssl_ca_file parameters. + If dovecot.index.cache corruption is detected, reset only the one corrupted mail instead of the whole file. + doveadm mailbox status: Add "firstsaved" field. + director_flush_socket: Add old host's up/down and vhost count as parameters - More fixes to automatically fix corruption in dovecot.list.index - dsync-server: Fix support for dsync_features=empty-header-workaround - imapc: Various bugfixes, including infinite loops on some errors - fts-lucene: Fix it to work again with mbox format - vpopmail: Fix compiling

1 0

v2.2.29.1 released
by Timo Sirainen 12 Apr '17

12 Apr '17

https://dovecot.org/releases/2.2/dovecot-2.2.29.1.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.29.1.tar.gz.sig Mainly because I had missed one cherry-pick from the release, which caused unit tests to also fail. And I didn't notice that, because make distcheck had been broken for some years now when it ran clang static analyzer, although I had assumed it would have run make check already before it failed.. On a related note, we're looking for a test engineer :) http://avoimettyopaikat.monster.fi/v2/job/View?JobID=182881783 - imapc reconnection fix was forgotten from 2.2.29 release, which also made "make check" fail in a unit test - dict-sql: Merging multiple UPDATEs to a single statement wasn't actually working. - Fixed building with vpopmail

1 0

Released Pigeonhole v0.4.18 for Dovecot v2.2.29.
by Stephan Bosch 12 Apr '17

12 Apr '17

Hello Dovecot users, Here's the definitive 0.4.18 release. There were no changes since the release candidate. Changelog v0.4.18: + imapsieve plugin: Implemented the copy_source_after rule action. When this is enabled for a mailbox rule, the specified Sieve script is executed for the message in the source mailbox during a "COPY" event. This happens only after the Sieve script that is executed for the corresponding message in the destination mailbox finishes running successfully. + imapsieve plugin: Added non-standard Sieve environment items for the source and destination mailbox. - multiscript: The execution of the discard script had an implicit "keep", rather than an implicit "discard". The release is available as follows: https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.18.t… https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.18.t… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

CVE-2017-2669: Dovecot DoS when passdb dict was used for authentication
by Aki Tuomi 11 Apr '17

11 Apr '17

CVSS: 6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vulnerable versions: 2.2.26 - 2.2.28 Fixed version(s): 2.2.29 Broken by a3783f8a3c9cd816b51e77a922f82301512fcf22 Fixed by 000030feb7a30f193197f1aab8a7b04a26b42735 Dovecot supports "dict" passdb and userdb: https://wiki2.dovecot.org/AuthDatabase/Dict When these were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang. Excessive memory usage could be done with e.g. %09999999999u as the username. Because by default Dovecot limits the auth process's VSZ and exits on any memory allocation failure, the auth process typically dies afterwards and is immediately restarted. This may result in some user authentications getting temporary internal failures. Excessive CPU usage could be done with %{pkcs5;rounds=100000000:user} variable introduced in v2.2.27. Please use this https://github.com/dovecot/core/commit/000030feb7a30f193197f1aab8a7b04a26b4… to fix this issue, it should be applicable to older versions too. Please let us know if you need assistance in patching. --- Aki Tuomi Dovecot oy

1 0