Dovecot v2.3.20 released

[Aki Tuomi]

> On 23/12/2022 14:23 EET Eray Aslan <eraya at a21an.org> wrote:
> 
>  
> On Fri, Dec 23, 2022 at 11:59:54AM +0200, Aki Tuomi wrote:
> > > On 23/12/2022 11:47 EET Eray Aslan <eraya at a21an.org> wrote:
> > > On Thu, Dec 22, 2022 at 10:06:16AM +0200, Aki Tuomi wrote:
> > > > We are pleased to release v2.3.20 of Dovecot.
> > > 
> > > Can you confirm that CVE-2022-30550 is patched in dovecot-2.3.20? Thank
> > > you.
> > 
> > We've decided to fix it for 2.4 release only, so it's not fixed in 2.3.20.
> 
> That is a surprising decision.
> 

The bug does not, in fact, affect that many setups, and we do not consider it to be practically that severe bug.

> One more question regarding openssl. I am getting test failures when
> building against openssl-3 but not when building against openssl-1.1.1s.
> Can you confirm if openssl-3 is supported?
> 
> [...]
> test-crypto.c:827: Assert failed: ret == TRUE
> Panic: file dcrypt-openssl.c: line 2639 (dcrypt_openssl_private_to_public_key): assertion failed: (priv_key != NULL && pub_key_r != NULL)
> Error: Raw backtrace: ./test-crypto(backtrace_append+0x42) [0x560ff72000b2] -> ./test-crypto(backtrace_get+0x1e) [0x560ff72001fe] -> ./test-crypto(+0x26952) [0x560ff71dd952] -> ./test-crypto(+0x26991) [0x560ff71dd991] -> ./test-crypto(+0x14e03) [0x560ff71cbe03] -> .libs/libdcrypt_openssl.so(+0x5f25) [0x7f5b1b499f25] -> ./test-crypto(+0x1f071) [0x560ff71d6071] -> ./test-crypto(+0x227cf) [0x560ff71d97cf] -> ./test-crypto(test_run+0x4a) [0x560ff71da2da] -> ./test-crypto(main+0x4f) [0x560ff71d032f] -> /lib64/libc.so.6(+0x232ca) [0x7f5b1b5322ca] -> /lib64/libc.so.6(__libc_start_main+0x85) [0x7f5b1b532385] -> ./test-crypto(_start+0x21) [0x560ff71d0451]
> make[3]: *** [Makefile:1137: check-local] Error 1
> [...]
> $ openssl version
> OpenSSL 3.0.7 1 Nov 2022 (Library: OpenSSL 3.0.7 1 Nov 2022)
> 
> Thank you
> -- 
> Eray

OpenSSL 3.0 support is also planned for 2.4.

Aki