- dovecot - dovecot.org

v2.3.5.2 released
by Aki Tuomi 18 Apr '19

18 Apr '19

Lets try again, put wrong changelog to the mail. Sorry about this. https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz.sig Binary packages in https://repo.dovecot.org/ * CVE-2019-10691: Trying to login with 8bit username containing invalid UTF8 input causes auth process to crash if auth policy is enabled. This could be used rather easily to cause a DoS. Similar crash also happens during mail delivery when using invalid UTF8 in From or Subject header when OX push notification driver is used. --- Aki Tuomi Open-Xchange oy

2 2

Problems with auth connection
by Fernando Ortega 18 Apr '19

18 Apr '19

Hi, We are having some issues with the auth connection Version: 2.3.5.1, with MySQL and Postfix The server is working fine, and randomly after some days, Dovecot fails to auth: Apr 18 14:25:16 mail dovecot[25013]: auth: Warning: Event 0x126eba20 leaked (parent=0x126eb820): auth-request.c:89 Apr 18 14:25:16 mail dovecot[25013]: auth: Warning: Event 0x126eb420 leaked (parent=0x0): auth-client-connection.c:338 It's neccesary to restart dovecot, and once restarted the server start to work fine again and deliver emails What do you think i could do? Thank you, best regards Fernando

1 0

ssl_verify_server_cert against SAN?
by TG Servers 18 Apr '19

18 Apr '19

3 5

CVE-2019-10691: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters.
by Aki Tuomi 18 Apr '19

18 Apr '19

Dear subscribers, we're sharing our latest advisory with you and would like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs (open-xchange, dovecot, powerdns) at HackerOne. You can find binary packages at https://repo.dovecot.org/ Yours sincerely, Aki Tuomi Open-Xchange Oy Open-Xchange Security Advisory 2019-04-18 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3173 (Bug ID) Vulnerability type: CWE-176 Vulnerable version: 2.3.0 - 2.3.5.1 Vulnerable component: json encoder Report confidence: Confirmed Researcher credits: cPanel L.L.C. Solution status: Fixed by Vendor Fixed version: 2.3.5.2 Vendor notification: 2019-04-02 Solution date: 2019-04-11 Public disclosure: 2019-04-18 CVE reference: CVE-2019-10691 CVSS: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters. This can be used to crash dovecot in two ways. Attacker can repeatedly crash Dovecot authentication process by logging in using invalid UTF-8 sequence in username. This requires that auth policy is enabled. Crash can also occur if OX push notification driver is enabled and an email is delivered with invalid UTF-8 sequence in From or Subject header. In 2.2, malformed UTF-8 sequences are forwarded "as-is", and thus do not cause problems in Dovecot itself. Target systems should be checked for possible problems in dealing with such sequences. See https://wiki.dovecot.org/Authentication/Policy for details on auth policy support. Risk: Determined attacker can prevent authentication process from staying up by keeping on attempting to log in with username containing invalid UTF-8 sequence. Steps to reproduce: Configure dovecot with auth_policy_server_url and auth_policy_hash_nonce set. Attempt to log in with username containing an invalid UTF-8 sequence Observe assert-crash in dovecot logs. Solution: Operators should update to the latest Patch Release or disable auth policy support.

1 0

v2.3.5.2 released
by Aki Tuomi 18 Apr '19

18 Apr '19

https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz.sig Binary packages in https://repo.dovecot.org/ * CVE-2019-7524: Missing input buffer size validation leads into arbitrary buffer overflow when reading fts or pop3 uidl header from Dovecot index. Exploiting this requires direct write access to the index files. --- Aki Tuomi Open-Xchange oy

1 0

Problem with mysql backend and SSL ciphers
by TG Servers 18 Apr '19

18 Apr '19

3 3

Documentation update
by azurit＠pobox.sk 18 Apr '19

18 Apr '19

Hi guys, this page needs to be updated: https://wiki2.dovecot.org/MailLocation/Maildir#Control_files (link was from here: https://wiki2.dovecot.org/MailLocation) Section 'Control files' is mentioning only 2 files but, in fact, Dovecot will store some additional files in CONTROL location: dovecot-uidvalidity dovecot-uidvalidity.* subscriptions (anything more?) Even more, page https://wiki2.dovecot.org/MailLocation has missing note to CONTROL files location about storing files 'dovecot-uidlist' and 'dovecot-keywords' of INBOX inside .INBOX directory instead of root directory (as it's stored inside mailbox). Missing anything from above will cause re-downloading of all e-mails by e-mail clients! And finally, i'm attaching a Python script which will safely copy/move CONTROL files from mail_location to new location (btw, moving it on SSD storage caused quite high performance boost in our environment). azur

2 1

Full mail
by Yevgeny Kosarzhevsky 18 Apr '19

18 Apr '19

Hello, I am getting strange messages on logs and I cannot find any reason. Could someone point me on what's wrong with my dovecot configuration? ~# dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9 ext4 ~# grep 'full mail' //var/log/dovecot.log Apr 16 19:25:43 imap(phaoost(a)phaoost.net)<15956><bv4DlqqGQNC5LcCN>: Debug: Mailbox INBOX: UID 3: Opened mail because: full mail Apr 16 19:29:06 imap(phaoost(a)phaoost.net)<17588><U1oXyKqGKNG5LcCN>: Debug: Mailbox INBOX: UID 4: Opened mail because: full mail Apr 16 20:28:19 imap(phaoost(a)phaoost.net)<21808><pT01V6uGgtO5LcCN>: Debug: Mailbox INBOX: UID 6: Opened mail because: full mail Apr 16 22:22:38 imap(phaoost(a)phaoost.net)<32077><lQTltKyGItq5LcCN>: Debug: Mailbox INBOX: UID 7: Opened mail because: full mail Apr 16 22:55:57 imap(phaoost(a)phaoost.net)<3732><hw1UQ62GWt25LcCN>: Debug: Mailbox INBOX: UID 8: Opened mail because: full mail Apr 16 23:37:12 imap(phaoost(a)phaoost.net)<8139><+2dd262G3N+5LcCN>: Debug: Mailbox INBOX: UID 9: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 3: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 4: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 5: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 6: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 7: Opened mail because: full mail Apr 17 04:34:44 imap(phaoost(a)phaoost.net)<23874><PC06DLKGaoC5LcCN>: Debug: Mailbox INBOX: UID 10: Opened mail because: full mail Apr 17 05:45:21 imap(phaoost(a)phaoost.net)<17176><fcoRZLOGHIW5LcCN>: Debug: Mailbox INBOX: UID 11: Opened mail because: full mail Apr 17 07:00:10 imap(phaoost(a)phaoost.net)<5348><bG6Ub7SGKom5LcCN>: Debug: Mailbox INBOX: UID 12: Opened mail because: full mail Apr 17 07:35:58 imap(phaoost(a)phaoost.net)<8078><QsTyj7SGyom5LcCN>: Debug: Mailbox INBOX: UID 13: Opened mail because: full mail Apr 17 08:25:17 imap(phaoost(a)phaoost.net)<29005><Zyr3n7WGIJC5LcCN>: Debug: Mailbox INBOX: UID 14: Opened mail because: full mail Apr 17 10:36:54 imap(phaoost(a)phaoost.net)<31565><TcqvdreGwJi5LcCN>: Debug: Mailbox INBOX: UID 15: Opened mail because: full mail Apr 17 11:08:27 imap(phaoost(a)phaoost.net)<7864><0+xW57eGjJq5LcCN>: Debug: Mailbox INBOX/Spam: UID 1: Opened mail because: full mail Apr 17 11:09:11 imap(phaoost(a)phaoost.net)<7864><0+xW57eGjJq5LcCN>: Debug: Mailbox Spam: UID 27: Opened mail because: full mail Apr 17 11:09:11 imap(phaoost(a)phaoost.net)<7864><0+xW57eGjJq5LcCN>: Debug: Mailbox Spam: UID 28: Opened mail because: full mail Apr 17 12:09:12 imap(phaoost(a)phaoost.net)<25908><bXnRwLiGKJ+5LcCN>: Debug: Mailbox Spam: UID 33: Opened mail because: full mail Apr 17 13:19:38 imap(phaoost(a)phaoost.net)<20835><El6SvLmGEKG5LcCN>: Debug: Mailbox Spam: UID 34: Opened mail because: full mail Apr 17 16:50:57 imap(phaoost(a)phaoost.net)<14923><hkpHsLyGYKa5LcCN>: Debug: Mailbox Spam: UID 35: Opened mail because: full mail Apr 17 16:50:57 imap(phaoost(a)phaoost.net)<14923><hkpHsLyGYKa5LcCN>: Debug: Mailbox Spam: UID 36: Opened mail because: full mail Apr 17 18:50:56 imap(phaoost(a)phaoost.net)<14650><JJZsXb6GCq25LcCN>: Debug: Mailbox Spam: UID 37: Opened mail because: full mail Apr 17 18:50:56 imap(phaoost(a)phaoost.net)<14650><JJZsXb6GCq25LcCN>: Debug: Mailbox Spam: UID 38: Opened mail because: full mail -- Regards, Yevgeny

2 1

Sieve operation "send copy" not working since upgrade from dovecot 2.2.31-1 to 2.3.5.1-1
by Kristijan Savic - ratiokontakt GmbH 16 Apr '19

16 Apr '19

I hope that someone can help me here. Software: CentOS 7.6.1810, dovecot-2.3.5.1, dovecot-pigeonhole-2.3.5.1, exim 4.91-1 Example filter: # rule:[test] if header :contains "subject" "meow" { redirect :copy "ks(a)ratiokontakt.de"; } Mail log: Apr 16 11:29:02 frontend-17 dovecot: lmtp(testi(a)mrhoang.de)<25201><QPgZHF6gtVxxYgAARS1pjg>: sieve: msgid=<311099964.O2fbMfmo3K(a)ws-ks.intern.ratiokontakt.de>: failed to redirect message to <ks(a)ratiokontakt.de>: smtp(localhost): DATA failed: 552 Message header not CRLF terminated (permanent failure) Apr 16 11:29:02 frontend-17 dovecot: lmtp(testi(a)mrhoang.de)<25201><QPgZHF6gtVxxYgAARS1pjg>: sieve: msgid=<311099964.O2fbMfmo3K(a)ws-ks.intern.ratiokontakt.de>: stored mail into mailbox 'INBOX' Apr 16 11:29:02 frontend-17 dovecot: lmtp(testi(a)mrhoang.de)<25201><QPgZHF6gtVxxYgAARS1pjg>: sieve: Execution of script /usr/local/mail/0117/mrhoang.de/testi/.dovecot.sieve failed, but implicit keep was successful (user logfile /usr/local/mail/0117/mrhoang.de/ testi/.dovecot.sieve.log may reveal additional details) And in the: /.dovecot.sieve.log: sieve: info: started log at Apr 16 11:29:02. error: msgid=<311099964.O2fbMfmo3K(a)ws-ks.intern.ratiokontakt.de>: failed to redirect message to <ks(a)ratiokontakt.de>: smtp(localhost): DATA failed: 552 Message header not CRLF terminated (permanent failure) We are stumped. Any ideas? Regards, Kristijan Savic

2 2

Fwd: SOLR/Index?
by Larry Rosenman 15 Apr '19

15 Apr '19

forgot to reply all. ---------- Forwarded message --------- From: Larry Rosenman <larryrtx(a)gmail.com> Date: Mon, Apr 15, 2019 at 5:58 AM Subject: Re: SOLR/Index? To: John Fawcett <john(a)voipsupport.it> the local users (myself, my wife, a friend) can authenticate EITHER as <username> or <username>@lerctr.org. switching to all virtual users is NOT going to happen. If I login to roundcube with <user>@lerctr.org it finds the autoindexed mail. So, if I make everyone always authenticate as <user>@lerctr.org we should be fine. and change my script to do doveadm -u <user>@<domain> instead of depending on the local user running the cron job. question: Is there some way to have dovecot change what it sees to be <user>@lerctr.org when they login as <user>? On Mon, Apr 15, 2019 at 5:54 AM John Fawcett via dovecot < dovecot(a)dovecot.org> wrote: > On 15/04/2019 11:38, Larry Rosenman via dovecot wrote: > > ⌂63% [ler@thebighonker.lerctr.org:~] $ grep fts1970 mail/INBOX > ⌂67% [ler@thebighonker.lerctr.org:~] 1 $ mail -s "test fts1970" > ler(a)lerctr.org > test fts1970 > > test fts1970 > . > EOT > [ler@thebighonker.lerctr.org:~] $ mailq > [ler@thebighonker.lerctr.org:~] $ grep fts1970 mail/INBOX > Subject: test fts1970 > test fts1970 > test fts1970 > > > Apr 15 04:29:03 thebighonker exim[49528]: 1hFxvD-000Csq-P6 <= > ler(a)lerctr.org U=ler P=local S=388 > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(49364): Connect from local > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(ler(a)lerctr.org/49364): > save: box=INBOX, uid=175402, msgid=< > E1hFxvD-000Csq-P6(a)thebighonker.lerctr.org>, size=640, vsize=660, > from=Larry Rosenman <ler(a)lerctr.org>, subject=test fts1970, flags=() > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(ler(a)lerctr.org/49364): > sieve: msgid=<E1hFxvD-000Csq-P6(a)thebighonker.lerctr.org>: stored mail > into mailbox 'INBOX' (subject=test fts1970 from=ler(a)lerctr.org size=660) > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(49364): Disconnect from > local: Client has quit the connection (state=READY) > Apr 15 04:29:03 thebighonker exim[49535]: 1hFxvD-000Csq-P6 => ler < > ler(a)lerctr.org> R=localuser T=dovecot_lmtp S=404 C="250 2.0.0 < > ler(a)lerctr.org> 6ACWMN9OtFzUwAAAu+mOrA Saved" QT=0s DT=0s > Apr 15 04:29:03 thebighonker exim[49535]: 1hFxvD-000Csq-P6 Completed QT=0s > Apr 15 04:29:03 thebighonker dovecot[2507]: indexer-worker( > ler(a)lerctr.org/49366) Indexed 1 messages in INBOX (UIDs 175402..175402) > > > ⌂81% [ler@thebighonker.lerctr.org:~] $ doveadm search mailbox INBOX body > 'fts1970' > ⌂83% [ler@thebighonker.lerctr.org:~] $ > > > ⌂65% [ler@thebighonker.lerctr.org:~] 75 $ doveadm search -u ler(a)lerctr.org > mailbox INBOX body 'fts1970' > a53a143be44bda5bd4830000bbe98eac 175402 > [ler@thebighonker.lerctr.org:~] $ doveadm index -q INBOX > [ler@thebighonker.lerctr.org:~] $ doveadm search mailbox INBOX body > 'fts1970' > [ler@thebighonker.lerctr.org:~] $ doveadm fts rescan > [ler@thebighonker.lerctr.org:~] $ doveadm index -q INBOX > [ler@thebighonker.lerctr.org:~] $ doveadm search mailbox INBOX body > 'fts1970' > a53a143be44bda5bd4830000bbe98eac 175402 > [ler@thebighonker.lerctr.org:~] $ doveadm search -u ler(a)lerctr.org > mailbox INBOX body 'fts1970' > a53a143be44bda5bd4830000bbe98eac 175402 > [ler@thebighonker.lerctr.org:~] $ > > So, yes, your hypothesis is correct. > > Question: How can I make it consistent? > > I have a script that runs on the first of the month that does archiving, > and I have similar issues in that namespace: > ⌂67% [ler@thebighonker.lerctr.org:~] $ cat bin/archive-mail > #!/bin/sh > PATH=$PATH:/usr/local/bin > #Expects to be run after midnight on the first of the month > # to archive all the previous months mail > #Date Run: > TODAY=`date "+%Y-%m-%d"` > #last month in YYYY/MM > YEAR_LAST_MONTH=`date -v-1d "+%Y/%m"` > #1st of last month as 01-Mon-YYYY > FIRST_LAST_MONTH=`date -v-1d "+01-%b-%Y"` > echo 'TODAY=' ${TODAY} > echo 'YEAR_LAST_MONTH=' ${YEAR_LAST_MONTH} > echo 'FIRST_LAST_MONTH=' ${FIRST_LAST_MONTH} > # get a list of all the mailboxes with at least one real message > doveadm -f tab mailbox status vsize \* 2>/dev/null | > sed -e 1d | sort -k 1,1 | > awk 'BEGIN {FS="\t"} {if ($2 > 0) print $1}' | > while read i > do > echo `date` start ${i} > doveadm mailbox create "ARCHIVE/${YEAR_LAST_MONTH}/${i}" > doveadm -f tab mailbox status messages "${i}" > doveadm move "ARCHIVE/${YEAR_LAST_MONTH}/${i}" mailbox \ > "${i}" BEFORE ${TODAY} SINCE ${FIRST_LAST_MONTH} > doveadm -f tab mailbox status messages "${i}" > echo `date` done ${i} > done > ⌂64% [ler@thebighonker.lerctr.org:~] $ > > > The Exim config can be provided as well if necessary. > > ler & ler(a)lerctr.org *ARE THE SAME MAILBOX* > > At the moment it looks as though you have two sets of emails indexed in > solr. One is indexed under username (the one you are running mannually and > apparently the one used by roundcube too, but that's to be verified) and > another set being indexed by autoindex = yes option using the full email > address. Once you've got it working as you require, then you may want to > clean out solr and reindex with just one of them just to reduce volumes. > > Your setup seems to have a mix of users from mysql and from /etc/passwd. > Not sure if your mysql users are all mapped to real users or they have > their own mailboxes with domain included. Your solution will depend on what > you really need and if the setup is working correctly you may not want to > tweak it too much or other things may start breaking. > > The simplest thing that comes to mind (providing your manually indexed > mails show up in roundcube searches) is just to turn off autoindex and > schedule indexing from cron. As things stand I believe autoindex works well > with virtual users username@domain. You'll probably need to start off > with a rescan if you do this. > > If you can swith to all virtual users without local users then probably > you can use autoindex, but I can understand that may not be possible. For > sure I'd recommend doing it in a test environment first so you can be sure > of the configuration and then look at migrating your existing mailboxes > over to virtual users. > > John > > > > -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106 -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

4 11