<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 5 Feb 2019 at 20:32, Aki Tuomi via dovecot <<a href="mailto:dovecot@dovecot.org">dovecot@dovecot.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Due to DMARC issues some people have failed to receive the latest security information, so here it is repeated for both releases:<br>
<br>
2.3.4.1<br>
<br>
<a href="https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz" rel="noreferrer" target="_blank">https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz</a><br>
<a href="https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz.sig" rel="noreferrer" target="_blank">https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz.sig</a><br>
<<a href="https://dovecot.org/releases/2.3/dovecot-2.3.2.tar.gz.sig" rel="noreferrer" target="_blank">https://dovecot.org/releases/2.3/dovecot-2.3.2.tar.gz.sig</a>><br>
Binary packages in <a href="https://repo.dovecot.org/" rel="noreferrer" target="_blank">https://repo.dovecot.org/</a><br>
<br>
* CVE-2019-3814: If imap/pop3/managesieve/submission client has<br>
trusted certificate with missing username field<br>
(ssl_cert_username_field), under some configurations Dovecot<br>
mistakenly trusts the username provided via authentication instead<br>
of failing.<br>
* ssl_cert_username_field setting was ignored with external SMTP AUTH,<br>
because none of the MTAs (Postfix, Exim) currently send the<br>
cert_username field. This may have allowed users with trusted<br>
certificate to specify any username in the authentication. This bug<br>
didn't affect Dovecot's Submission service.<br></blockquote><div><br></div><div>FreeBSD-11.2 (amd64):</div><div><br></div><div>gmake[2]: Entering directory '/usr/home/wash/Tools/Dovecot/2.3/dovecot-2.3.4.1/src/lib-master'</div><div>gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-dns -I../../src/lib-test -I../../src/lib-settings -I../../src/lib-ssl-iostream -DPKG_RUNDIR=\""/opt/dovecot2.3/var/run/dovecot"\" -DPKG_STATEDIR=\""/opt/dovecot2.3/var/lib/dovecot"\" -DSYSCONFDIR=\""/opt/dovecot2.3/etc/dovecot"\" -DBINDIR=\""/opt/dovecot2.3/bin"\" -std=gnu99 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/usr/local/include -MT test-event-stats.o -MD -MP -MF .deps/test-event-stats.Tpo -c -o test-event-stats.o test-event-stats.c</div><div>test-event-stats.c: In function 'kill_stats_child':</div><div>test-event-stats.c:101:2: warning: implicit declaration of function 'kill' [-Wimplicit-function-declaration]</div><div> (void)kill(stats_pid, SIGKILL);</div><div> ^</div><div>test-event-stats.c:101:24: error: 'SIGKILL' undeclared (first use in this function)</div><div> (void)kill(stats_pid, SIGKILL);</div><div> ^</div><div>test-event-stats.c:101:24: note: each undeclared identifier is reported only once for each function it appears in</div><div>gmake[2]: *** [Makefile:638: test-event-stats.o] Error 1</div><div>gmake[2]: Leaving directory '/usr/home/wash/Tools/Dovecot/2.3/dovecot-2.3.4.1/src/lib-master'</div><div>gmake[1]: *** [Makefile:565: install-recursive] Error 1</div><div>gmake[1]: Leaving directory '/usr/home/wash/Tools/Dovecot/2.3/dovecot-2.3.4.1/src'</div><div>gmake: *** [Makefile:683: install-recursive] Error 1</div><div><br></div><div> </div><div><br></div><div><br></div><div>FreeBSD-9.3:</div><div><br></div><div>gmake[3]: Entering directory '/usr/home/wash/Tools/Dovecot/2.3/dovecot-2.3.4.1/src/lib-master'</div><div>gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-dns -I../../src/lib-test -I../../src/lib-settings -I../../src/lib-ssl-iostream -DPKG_RUNDIR=\""/opt/dovecot2.3/var/run/dovecot"\" -DPKG_STATEDIR=\""/opt/dovecot2.3/var/lib/dovecot"\" -DSYSCONFDIR=\""/opt/dovecot2.3/etc/dovecot"\" -DBINDIR=\""/opt/dovecot2.3/bin"\" -std=gnu99 -g -O2 -fstack-protector -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/usr/local/include -MT test-event-stats.o -MD -MP -MF .deps/test-event-stats.Tpo -c -o test-event-stats.o test-event-stats.c</div><div>test-event-stats.c: In function 'kill_stats_child':</div><div>test-event-stats.c:101: warning: implicit declaration of function 'kill'</div><div>test-event-stats.c:101: error: 'SIGKILL' undeclared (first use in this function)</div><div>test-event-stats.c:101: error: (Each undeclared identifier is reported only once</div><div>test-event-stats.c:101: error: for each function it appears in.)</div><div>test-event-stats.c: In function 'test_no_merging2':</div><div>test-event-stats.c:361: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'uint64_t'</div><div>test-event-stats.c: In function 'test_no_merging3':</div><div>test-event-stats.c:387: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'uint64_t'</div><div>test-event-stats.c:387: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'uint64_t'</div><div>test-event-stats.c:387: warning: format '%lu' expects type 'long unsigned int', but argument 6 has type 'uint64_t'</div><div>test-event-stats.c: In function 'test_merge_events2':</div><div>test-event-stats.c:452: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'uint64_t'</div><div>test-event-stats.c: In function 'test_skip_parents':</div><div>test-event-stats.c:484: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'uint64_t'</div><div>test-event-stats.c:484: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'uint64_t'</div><div>test-event-stats.c:484: warning: format '%lu' expects type 'long unsigned int', but argument 6 has type 'uint64_t'</div><div>test-event-stats.c: In function 'test_merge_events_skip_parents':</div><div>test-event-stats.c:526: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'uint64_t'</div><div>test-event-stats.c:526: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'uint64_t'</div><div>test-event-stats.c:526: warning: format '%lu' expects type 'long unsigned int', but argument 6 has type 'uint64_t'</div><div>Makefile:638: recipe for target 'test-event-stats.o' failed</div><div>gmake[3]: *** [test-event-stats.o] Error 1</div><div>gmake[3]: Leaving directory '/usr/home/wash/Tools/Dovecot/2.3/dovecot-2.3.4.1/src/lib-master'</div><div>Makefile:565: recipe for target 'all-recursive' failed</div><div>gmake[2]: *** [all-recursive] Error 1</div><div>gmake[2]: Leaving directory '/usr/home/wash/Tools/Dovecot/2.3/dovecot-2.3.4.1/src'</div><div>Makefile:683: recipe for target 'all-recursive' failed</div><div>gmake[1]: *** [all-recursive] Error 1</div><div>gmake[1]: Leaving directory '/usr/home/wash/Tools/Dovecot/2.3/dovecot-2.3.4.1'</div><div>Makefile:527: recipe for target 'all' failed</div><div>gmake: *** [all] Error 2</div><div>[wash@gw ~/Tools/Dovecot/2.3/dovecot-2.3.4.1]$</div><div><br></div><div><br></div><div><br></div><div><br></div><div>FreeBSD-8.4:</div><div><br></div><div>Making all in lib-master</div><div>source='test-event-stats.c' object='test-event-stats.o' libtool=no DEPDIR=.deps depmode=none /bin/bash ../../depcomp gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-dns -I../../src/lib-test -I../../src/lib-settings -I../../src/lib-ssl-iostream -DPKG_RUNDIR=\""/opt/dovecot2.3/var/run/dovecot"\" -DPKG_STATEDIR=\""/opt/dovecot2.3/var/lib/dovecot"\" -DSYSCONFDIR=\""/opt/dovecot2.3/etc/dovecot"\" -DBINDIR=\""/opt/dovecot2.3/bin"\" -std=gnu99 -g -O2 -fstack-protector -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/usr/local/include -c -o test-event-stats.o test-event-stats.c</div><div>test-event-stats.c: In function 'kill_stats_child':</div><div>test-event-stats.c:101: warning: implicit declaration of function 'kill'</div><div>test-event-stats.c:101: error: 'SIGKILL' undeclared (first use in this function)</div><div>test-event-stats.c:101: error: (Each undeclared identifier is reported only once</div><div>test-event-stats.c:101: error: for each function it appears in.)</div><div>test-event-stats.c: In function 'test_no_merging2':</div><div>test-event-stats.c:361: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'uint64_t'</div><div>test-event-stats.c: In function 'test_no_merging3':</div><div>test-event-stats.c:387: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'uint64_t'</div><div>test-event-stats.c:387: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'uint64_t'</div><div>test-event-stats.c:387: warning: format '%lu' expects type 'long unsigned int', but argument 6 has type 'uint64_t'</div><div>test-event-stats.c: In function 'test_merge_events2':</div><div>test-event-stats.c:452: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'uint64_t'</div><div>test-event-stats.c: In function 'test_skip_parents':</div><div>test-event-stats.c:484: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'uint64_t'</div><div>test-event-stats.c:484: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'uint64_t'</div><div>test-event-stats.c:484: warning: format '%lu' expects type 'long unsigned int', but argument 6 has type 'uint64_t'</div><div>test-event-stats.c: In function 'test_merge_events_skip_parents':</div><div>test-event-stats.c:526: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'uint64_t'</div><div>test-event-stats.c:526: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'uint64_t'</div><div>test-event-stats.c:526: warning: format '%lu' expects type 'long unsigned int', but argument 6 has type 'uint64_t'</div><div>*** Error code 1</div><div><br></div><div>Stop.</div><div>make: stopped in /usr/home/wash/Tools/Dovecot/2.3/dovecot-2.3.4.1/src/lib-master</div><div>*** Error code 1</div><div><br></div><div>Stop.</div><div>make: stopped in /usr/home/wash/Tools/Dovecot/2.3/dovecot-2.3.4.1/src</div><div>*** Error code 1</div><div><br></div><div>Stop.</div><div>make: stopped in /home/wash/Tools/Dovecot/2.3/dovecot-2.3.4.1</div><div>Makefile:527: recipe for target 'all' failed</div><div>gmake: *** [all] Error 1</div><div>(23:18:46 <~/Tools/Dovecot/2.3/dovecot-2.3.4.1>) 0 $</div><div><br></div><div> </div></div><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div>Best regards,<br>Odhiambo WASHINGTON,<br>Nairobi,KE<br>+254 7 3200 0004/+254 7 2274 3223<br>"<span style="font-size:12.8px">Oh, the cruft.</span><span style="font-size:12.8px">", </span><span style="font-size:12.8px">grep ^[^#] :-)</span></div></div></div></div></div></div></div></div></div>