- dovecot - dovecot.org

Is is possible to log TLS client versions
by Götz Reinicke 13 Dec '19

13 Dec '19

Hi, is it possible to log the version of TLS a clients is using to connect to dovecot? I’v not found any switch to do that. Thanks and regards . Götz

2 2

CVE-2019-19722: Critical vulnerability in Dovecot
by Aki Tuomi 13 Dec '19

13 Dec '19

Open-Xchange Security Advisory 2019-12-13 Product: Dovecot IMAP/POP3 Server Vendor: OX Software GmbH Internal reference: DOV-3719 Vulnerability type: NULL Pointer Dereference (CWE-476) Vulnerable version: 2.3.9 Vulnerable component: push notification driver Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.9.1 Researcher credits: Frederik Schwan, Michael Stilkerich Vendor notification: 2019-12-10 Solution date: 2019-12-12 Public disclosure: 2019-12-13 CVE reference: CVE-2019-19722 CVSS: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:O/RC:C) Vulnerability Details: Mail with group address as sender will cause a signal 11 crash in push notification drivers. Group address as recipient can cause crash in some drivers. Risk: Repeated delivery attempts are made for the problematic mail, causing queueing in MTA. Steps to reproduce: 1. Configure dovecot with push notifications enabled, such as OX push notification driver. This can also be observed with 3rd party plugin XAPS. 2. Send mail a group address as sender Solution: Operators should update to the latest Patch Release.

2 1

Dovecot 2.3.9 - lmtp crashes with Signal 11
by Michael Stilkerich 13 Dec '19

13 Dec '19

Hello, since the upgrade from 2.3.8 to 2.3.9 (using the Ubuntu 18.04 packages from dovecot.org) lmtp crashes for me for some mails. Currently I have three pending mails in my postfix deferred queue since the upgrade a couple of days ago. I did not observe these issues with 2.3.8. The backtrace from one of the coredumps: Reading symbols from /usr/lib/dovecot/lmtp...Reading symbols from /usr/lib/debug/.build-id/f3/3a5089463b1234cbcf90bf10033d1dd5613821.debug...done. done. [New LWP 1554] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `dovecot/lmtp'. Program terminated with signal SIGSEGV, Segmentation fault. #0 decode_address_header (pool=pool@entry=0x560631ad6d10, hdr=0x560631add4c8 "", address_r=address_r@entry=0x560631ad7090, name_r=name_r@entry=0x560631ad7098) at push-notification-event-message-common.c:20 20 push-notification-event-message-common.c: No such file or directory. (gdb) bt #0 decode_address_header (pool=pool@entry=0x560631ad6d10, hdr=0x560631add4c8 "", address_r=address_r@entry=0x560631ad7090, name_r=name_r@entry=0x560631ad7098) at push-notification-event-message-common.c:20 #1 0x00007f3f37955fbb in decode_address_header (name_r=0x560631ad7098, address_r=0x560631ad7090, hdr=<optimized out>, pool=0x560631ad6d10) at push-notification-event-message-common.c:62 #2 push_notification_message_fill (mail=mail@entry=0x560631adc088, pool=0x560631ad6d10, event_flags=(PUSH_NOTIFICATION_MESSAGE_HDR_FROM | PUSH_NOTIFICATION_MESSAGE_HDR_TO | PUSH_NOTIFICATION_MESSAGE_HDR_SUBJECT | PUSH_NOTIFICATION_MESSAGE_HDR_DATE | PUSH_NOTIFICATION_MESSAGE_BODY_SNIPPE$), from=<optimized out>, to=<optimized out>, subject=<optimized out>, date=0x560631ad7050, date_tz=0x560631ad7058, message_id=0x560631ad7078, flags=0x560631ad706c, flags_set=0x560631ad7068, keywords=0x560631ad7070, snippet=0x560631ad7060, ext=0x560631ad7080) at push-notification-event-message-common.c:62 #3 0x00007f3f37955a41 in push_notification_event_messagenew_event (ptxn=0x560631ad6d38, ec=0x560631ad6fe0, msg=0x560631ad7010, mail=0x560631adc088) at push-notification-event-messagenew.c:83 #4 0x00007f3f379571bd in push_notification_trigger_msg_save_new (txn=0x560631ad6d38, mail=0x560631adc088, msg=0x560631ad7010) at push-notification-triggers.c:138 #5 0x00007f3f383f52f3 in notify_contexts_mail_save (mail=0x560631adc088) at notify-plugin.c:62 #6 0x00007f3f383f65b8 in notify_copy (ctx=0x560631ad7890, mail=0x560631a98b18) at notify-storage.c:104 #7 0x00007f3f3860873d in quota_copy (ctx=0x560631ad7890, mail=0x560631a98b18) at quota-storage.c:302 #8 0x00007f3f39f91e32 in mailbox_copy_int (_ctx=<optimized out>, mail=0x560631a98b18) at mail-storage.c:2759 #9 0x00007f3f3641907f in ?? () from /usr/lib/dovecot/libdovecot-sieve.so.0 #10 0x00007f3f3640e64c in ?? () from /usr/lib/dovecot/libdovecot-sieve.so.0 #11 0x00007f3f3640f11b in sieve_result_implicit_keep () from /usr/lib/dovecot/libdovecot-sieve.so.0 #12 0x00007f3f364226e1 in sieve_multiscript_finish () from /usr/lib/dovecot/libdovecot-sieve.so.0 #13 0x00007f3f3668e488 in ?? () from /usr/lib/dovecot/modules/lib90_sieve_plugin.so #14 0x00007f3f3a2a260d in mail_do_deliver (storage_r=0x7ffedf944b40, ctx=0x7ffedf944c30) at mail-deliver.c:542 #15 mail_deliver (ctx=ctx@entry=0x7ffedf944c30, storage_r=storage_r@entry=0x7ffedf944b40) at mail-deliver.c:592 #16 0x000056063169c0e1 in lmtp_local_default_deliver (client=0x560631a5e898, lrcpt=<optimized out>, cmd=<optimized out>, trans=<optimized out>, lldctx=0x7ffedf944e70) at lmtp-local.c:593 #17 0x000056063169c8cf in lmtp_local_deliver (local=0x560631a849b0, local=0x560631a849b0, session=0x560631a9d748, src_mail=0x560631a98b18, llrcpt=0x560631a7f600, trans=0x560631a7fab8, cmd=0x560631a7f088) at lmtp-local.c:530 #18 lmtp_local_deliver_to_rcpts (session=0x560631a9d748, trans=0x560631a7fab8, cmd=0x560631a7f088, local=0x560631a849b0) at lmtp-local.c:654 #19 lmtp_local_data (client=client@entry=0x560631a5e898, cmd=cmd@entry=0x560631a7f088, trans=trans@entry=0x560631a7fab8, input=<optimized out>) at lmtp-local.c:730 #20 0x000056063169b0cf in client_default_cmd_data (client=0x560631a5e898, cmd=0x560631a7f088, trans=0x560631a7fab8, data_input=0x560631a83c00, data_size=<optimized out>) at lmtp-commands.c:275 #21 0x000056063169ae6f in cmd_data_finish (trans=0x560631a7fab8, cmd=0x560631a7f088, client=0x560631a5e898) at lmtp-commands.c:165 #22 cmd_data_continue (conn_ctx=0x560631a5e898, cmd=0x560631a7f088, trans=0x560631a7fab8) at lmtp-commands.c:213 #23 0x00007f3f39bfa2c7 in cmd_data_do_handle_input (cmd=0x560631a7f088) at smtp-server-cmd-data.c:285 #24 cmd_data_handle_input (cmd=0x560631a7f088) at smtp-server-cmd-data.c:333 #25 0x00007f3f39ca42af in io_loop_call_io (io=0x560631a7d8e0) at ioloop.c:718 #26 0x00007f3f39ca5c8c in io_loop_handler_run_internal (ioloop=ioloop@entry=0x560631a23fd0) at ioloop-epoll.c:222 #27 0x00007f3f39ca43c0 in io_loop_handler_run (ioloop=<optimized out>) at ioloop.c:770 #28 0x00007f3f39ca45e8 in io_loop_run (ioloop=0x560631a23fd0) at ioloop.c:743 #29 0x00007f3f39c124b3 in master_service_run (service=0x560631a23e60, callback=<optimized out>) at master-service.c:809 #30 0x0000560631699b45 in main (argc=<optimized out>, argv=<optimized out>) at main.c:169 I can provide one of the mails causing the crash if helpful (they are all spam). Best regards, Michael

2 7

Dovecot v2.3.9.1 released
by Aki Tuomi 13 Dec '19

13 Dec '19

Hi all! We are pleased to release v2.3.9.1 of Dovecot. Please find it from locations below https://dovecot.org/releases/2.3/dovecot-2.3.9.1.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.9.1.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot --- * CVE-2019-19722: Mails with group addresses in From or To fields caused crash in push notification drivers. --- Aki Tuomi Open-Xchange oy

1 0

Dovecot auth crashing??
by Odhiambo Washington 13 Dec '19

13 Dec '19

Dovecot-2.3.9 I am seeing a lot of the following on my logs: Dec 13 09:16:25 auth: Warning: Timeout leak: 0x105fb00 (auth-request-handler.c:584) Dec 13 09:16:25 auth: Warning: Timeout leak: 0x105fb00 (auth-request-handler.c:584) Dec 13 09:16:25 auth: Warning: Timeout leak: 0x105fb00 (auth-request-handler.c:584) Dec 13 09:16:25 auth: Warning: Event 0x827d6e20 leaked (parent=0x827d4220): auth-request.c:878 Dec 13 09:16:25 auth: Warning: Event 0x827d6420 leaked (parent=0x827d4820): auth-request.c:878 Dec 13 09:16:25 auth: Warning: Event 0x82780c20 leaked (parent=0x827d6220): auth-request.c:878 Dec 13 09:16:25 auth: Warning: Event 0x827d6c20 leaked (parent=0x827d4220): auth-request.c:115 Dec 13 09:16:25 auth: Warning: Event 0x827d4220 leaked (parent=0x827d6a20): auth-request.c:114 Dec 13 09:16:25 auth: Warning: Event 0x827d6a20 leaked (parent=0x0): auth-client-connection.c:338 Dec 13 09:16:25 auth: Warning: Event 0x827d4c20 leaked (parent=0x827d4820): auth-request.c:115 Dec 13 09:16:25 auth: Warning: Event 0x827d4820 leaked (parent=0x827fe620): auth-request.c:114 Dec 13 09:16:25 auth: Warning: Event 0x827fe620 leaked (parent=0x0): auth-client-connection.c:338 Dec 13 09:16:25 auth: Warning: Event 0x827ff420 leaked (parent=0x827d6220): auth-request.c:115 Dec 13 09:16:25 auth: Warning: Event 0x827d6220 leaked (parent=0x82780e20): auth-request.c:114 Dec 13 09:16:25 auth: Warning: Event 0x82780e20 leaked (parent=0x0): auth-client-connection.c:338 Dec 13 11:27:29 master: Warning: Killed with signal 15 (by pid=9326 uid=0 code=kill) Dec 13 11:27:37 master: Warning: Killed with signal 15 (by pid=16518 uid=0 code=kill) Dec 13 11:27:38 auth: Error: net_connect_unix(auth-worker) failed: No such file or directory Dec 13 11:27:39 auth: Error: net_connect_unix(auth-worker) failed: No such file or directory Dec 13 11:27:59 auth: Error: net_connect_unix(/var/run/dovecot//stats-writer) failed: No such file or directory Dec 13 11:27:59 auth: Warning: Timeout leak: 0x105fb00 (auth-request-handler.c:584) Dec 13 11:27:59 auth: Warning: Timeout leak: 0x105fb00 (auth-request-handler.c:584) Dec 13 11:27:59 auth: Warning: Event 0x82781a20 leaked (parent=0x827d4620): auth-request.c:878 Dec 13 11:27:59 auth: Warning: Event 0x827d4220 leaked (parent=0x827d4820): auth-request.c:878 Dec 13 11:27:59 auth: Warning: Event 0x82780e20 leaked (parent=0x827d4620): auth-request.c:115 Dec 13 11:27:59 auth: Warning: Event 0x827d4620 leaked (parent=0x827d0820): auth-request.c:114 Dec 13 11:27:59 auth: Warning: Event 0x827d0820 leaked (parent=0x0): auth-client-connection.c:338 Dec 13 11:27:59 auth: Warning: Event 0x82781220 leaked (parent=0x827d4820): auth-request.c:115 Dec 13 11:27:59 auth: Warning: Event 0x827d4820 leaked (parent=0x827d0c20): auth-request.c:114 Dec 13 11:27:59 auth: Warning: Event 0x827d0c20 leaked (parent=0x0): auth-client-connection.c:338 Dec 13 11:28:07 auth: Warning: Timeout leak: 0x105fb00 (auth-request-handler.c:584) Dec 13 11:28:07 auth: Warning: Event 0x82780c20 leaked (parent=0x82781c20): auth-request.c:878 Dec 13 11:28:07 auth: Warning: Event 0x82781e20 leaked (parent=0x82781c20): auth-request.c:115 Dec 13 11:28:07 auth: Warning: Event 0x82781c20 leaked (parent=0x82781a20): auth-request.c:114 Dec 13 11:28:07 auth: Warning: Event 0x82781a20 leaked (parent=0x0): auth-client-connection.c:338 -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

1 0

dovecot update from 2.1.16 to 2.2.36.4 but I have a trouble.
by iriya＠peach.ocn.ne.jp 13 Dec '19

13 Dec '19

Hi,I have a troble and can not resolve it. Please help me. I updated dovecot from 2.1.16 to 2.2.36.4. As a result, I had a client who could not access via imap. The client showed his logs (- folder not exists:INBOX ) I did not change dovecot config files. So I searched a difference between 2.1.16 and 2.2.36.4, I discovered . Please refer below results. [2.1.16] a03 list "" "*" * LIST (\HasChildren) "." "INBOX" * LIST (\HasNoChildren) "." "INBOX.Drafts" * LIST (\HasNoChildren) "." "INBOX.Sent" * LIST (\HasNoChildren) "." "INBOX.Spam" * LIST (\HasNoChildren) "." "INBOX.Trash" [2.2.36.4] a03 list "" "*" * LIST (\HasChildren) "." INBOX * LIST (\HasNoChildren) "." INBOX.Drafts * LIST (\HasNoChildren) "." INBOX.Sent * LIST (\HasNoChildren) "." INBOX.Spam * LIST (\HasNoChildren) "." INBOX.Trash For example, I noticed INBOX and "INBOX". 2.2.36.4 dovecot is no [""]. What should I do?

2 1

v2.2.36 to v2.3.8 maildirlock bug
by lty＠cndns.com 12 Dec '19

12 Dec '19

Dear all, Dovecot upgraded from v2.2.36 to v2.3.8 There is no problem with the configuration, but the lock directory seems to have an error. [root@spam dovecot]# /usr/libexec/dovecot/maildirlock /path/to/maildir 1 Panic: BUG: No IOs or timeouts set. Not waiting for infinity. 19276[root@spam dovecot]# Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0xe227a) [0x7f1cb567a27a] -> /usr/lib64/dovecot/libdovecot.so.0(+0xe2321) [0x7f1cb567a321] -> /usr/lib64/dovecot/libdovecot.so.0(+0x40f31) [0x7f1cb55d8f31] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf93b4) [>xrf1cb56913b4] -> /usr/ Lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x28) [0x7f1cb5693918] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x5c) [0x7f1cb5691aac] -> /usr/lib64/dovecot/libdovecot. So.0(io_loop_run+0x38) [0x7f1cb5691cc8] -> /usr/libexec/dovecot/maildirlock(main+0x242) [0x7f1cb5b522c2] -> /lib64/libc.so.6(__libc_start_main+0x100) [0x7f1cb5222d20] -> / Usr/libexec/dovecot/maildirlock(+0xfa9) [0x7f1cb5b51fa9] After google seems to be a bug, this is the address Https://bugs.gentoo.org/682498 If this is not fixed, we are temporarily unable to upgrade to use the new version. Will the next version be fixed? We are looking forward to seeing that we have returned v2.2.36

4 5

Lightweight LMTP daemon to avoid overkill MTA
by William Edwards 12 Dec '19

12 Dec '19

Hi, My situation is as follows. -An internet-facing spam filter relays email to destination mail server (Dovecot) with SMTP. - Dovecot should take email and deliver it to user's mailboxes. I guess I'd need LMTP for this. - An external SMTP relay is already in place. I am thinking of using Dovecot submission to relay to the external relaying cluster. So, both relaying and routing are done externally - the Dovecot machine should only store mail. Of course, there should also be a mechanism that takes care of local delivery to Dovecot, like LMTP. Usually, I would use an MTA like Exim to take care of local delivery. I feel like a fully-featured MTA is overkill, though, as all other roles such an MTA would fulfill - relaying and spam filtering - are fulfilled on external servers. Q: Does anyone know of a lightweight LMTP daemon that can take care of local delivery to Dovecot without the need for a full MTA? With kind regards, William Edwards T. 040 - 711 44 96 E. wedwards(a)cyberfusion.nl

3 7

Submission config being ignored
by William Edwards 12 Dec '19

12 Dec '19

I'm having trouble setting up submission with Dovecot proxy. The submission config seems to be getting ignored, but I'm probably doing something wrong. Expected behaviour: have messages sent to submission ports (25, 465) relayed to `submission_relay_host`. -- root@imapproxy1:~# cat /etc/dovecot/conf.d/20-submission.conf submission_logout_format = in=%i out=%o submission_relay_host = smtp.prorelay.nl submission_relay_port = 587 submission_relay_ssl = starttls submission_relay_ssl_verify = no service submission { } service submission-login { inet_listener submission_25 { port = 25 } inet_listener submission_465 { port = 465 ssl = yes } } -- What happens instead: Dovecot is attempting to send mail to the host specified in the passdb file: root@imapproxy1:~# cat /etc/virtual/xalys.nl/passwd test:$password.:8:8::/home/test.nl/test:/bin/false:userdb_quota_rule=*:bytes=0 proxy_maybe=y host=$ipaddr How do I get Dovecot to relay mail sent to submission ports to 'submission_relay_host'? Met vriendelijke groeten, William Edwards T. 040 - 711 44 96 E. wedwards(a)cyberfusion.nl submission_relay_host

2 2

Duplicate e-mail with Dovecot and Sieve
by Claudio Corvino 12 Dec '19

12 Dec '19

Hi everyone, we have a duplicate e-mail problem with Dovecot 2.2.13 (LMTP as MDA) on a Debian 8 server. Our users are on external LDAP. We just need to setup a vacation responder (with Sieve) for our employees with a redirect to an alias (a distribution list), let's call it /LIST(a)domain.com/, that comprehends even the user that just activated the out of office. This generates a loop: when someone write to LIST(a)domain.com every user of the aforementioned distribution list receives a duplicate e-mail generated from the sieve script of the user with vacation responder active that contains the redirect to LIST(a)domain.com. We just tried activating the duplicate extension into sieve script but the redirected e-mail has a different MSG-ID and it's not recognized as a duplicate by the server. Our dovecot conf is: /# 2.2.13: /etc/dovecot/dovecot.conf auth_mechanisms = plain login default_vsz_limit = 512 M disable_plaintext_auth = no dotlock_use_excl = no info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_fsync = never mail_location = maildir:~/Maildir mail_max_userip_connections = 50 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate mmap_disable = yes passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap-archive.conf driver = ldap } plugin { sieve = file:/var/www/html/ooo/%n/script sieve_dir = /var/www/html/ooo/%n/ sieve_duplicate_default_period = 1m sieve_duplicate_max_period = 1d sieve_extensions = +vnd.dovecot.duplicate +notify +imapflags +vacation-seconds sieve_global = /etc/dovecot/sieve/ sieve_max_redirects = 10 sieve_user_log = file:/var/www/html/ooo/%n/sieve_error.log sieve_vacation_default_period = 1d sieve_vacation_max_period = 90d sieve_vacation_min_period = 5s } protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { process_limit = 200 } service lmtp { executable = lmtp -L process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } user = vmail } service managesieve-login { executable = /usr/lib/dovecot/managesieve-login inet_listener sieve { port = 4190 } process_min_avail = 10 service_count = 1 } service managesieve { executable = /usr/lib/dovecot/managesieve } ssl_cert = </etc/ssl/*xxxxxxxxxxxxxxxxxxxxxxxx* ssl_cipher_list = ALL:!LOW:!aNULL:!eNULL:!SSLv2:!RC4:!MD5:!DES:!EXP:!SEED:!IDEA:!3DES ssl_key = </etc/ssl/private/*xxxxxxxxxxxxxxxxxx* userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } userdb { args = /etc/dovecot/dovecot-ldap-archive.conf driver = ldap } protocol lda { auth_socket_path = /var/run/dovecot/auth-master hostname = *xxxxxxxxxxxxxxxxx* info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.log mail_plugins = " autocreate sieve quota" } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log log_path = /var/log/dovecot-lmtp-errors.log mail_plugins = " autocreate sieve quota" postmaster_address = postmaster@*xxxxxxxxxx* } protocol sieve { info_log_path = log_path = mail_max_userip_connections = 10 managesieve_implementation_string = dovecot managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 65536 }/ An example of user sieve script is: /require ["vnd.dovecot.duplicate","copy","fileinto","vacation-seconds"]; # rule:[Outofoffice] if true { vacation :addresses "xxxxxxx(a)domain.tld" :subject "Automatic Reply" text: / /<Text here> . ; fileinto "INBOX";/ / redirect "LIST(a)domain.com";/ /}/ Please could someone give us support on the matter? Removing the redirect from sieve user script is not an option :-) Thanks Cheers -- *Claudio Corvino IT Systems Administrator* Trust Italia S.p.A. <https://www.trustitalia.it/> *DigiCert Italian Affiliate Certified Partner Platinum Elite* Via Flaminia, 497 - 00191 Roma *tel.: +39 06332287* *fax: +39 063336145* *e-mail: * ccorvino(a)trustitalia.it <mailto:ccorvino@trustitalia.it> *website: * www.trustitalia.it <https://www.trustitalia.it> Symantec Authentication Service Le modalità di trattamento dei dati a cui è stato dato il consenso e le relative finalità sono consultabili al link <https://www.trustitalia.it/archivio/legal_agreements/informativa_privacy_em…>. Qualora non desiderasse ricevere le nostre comunicazioni, potrà comunicarlo mediante il seguente link <https://www.trustitalia.it/site/info_css/05110101/revoca-del-consenso>. Inoltre, in ogni momento, potrà modificare o cancellare i dati presenti nel nostro archivio contattandoci all'indirizzo privacy(a)trustitalia.it <mailto:privacy@trustitalia.it> Se possibile non stamparmi! Se possibile, non stamparmi!

8 13