Accepting request 806987 from home:stroeder:branches:server:mail

update to 2.3.10.1 with security fixes

OBS-URL: https://build.opensuse.org/request/show/806987
OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=71

dovecot-2.3.10.1.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6642e62f23b1b23cfac235007ca6e21cb67460cca834689fad450724456eb10c
+size 7226958

dovecot-2.3.10.1.tar.gz.sig

@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQJLBAABCAA1FiEEK+dKqz7nVN+5yA0zGKNIru1AnaEFAl7CQmQXHGRvdmVjb3Qt
+Y2VAZG92ZWNvdC5vcmcACgkQGKNIru1AnaGKng/+KOljo/BTYEBFL+rn38eDhhZC
+nCzbAJZl6GOYMnrN0vuEExJoQ7B9Bqy4HlO0iFsYXyD7nsOVpsfyF9z8tkk0RYCd
+PLxUCuzMrQml1af9kygghm03/PUflfsV/zu3cBzh3vy0Bygflhrr+CVWjAvauD5y
+DFGjULHZhJnNm1PG2Wwk/2Unr8MI9erXY4TG0b2hGgTxV6orZoLj1MyhPKdmVM6n
+LXYwrkhnK+RGIwISJKZVdYHAiFO7XNVgpw9gQtKff+Vs3Sa9aA2F1cGJ2Y0p+azb
++wQFLObGy/Rn87pQRkI3KPo9er3QCEwOfQQmECCnk4Aj/qhwnu7OEMrz3kj3IlLU
+uWOjzfIro0STiFqUnpZnFYVzTYgGmVUV/6mYkiYFdiVhRBPqQ2TTCsPlWPF8LXGo
+9epFAzpuCjBP+hhfrFP03CLF5B6BvDx76bB1hTacJJr1McAP4Cw7UTB9WzSEU8BX
+X5I3BAnCL8VJ73hHFWL/Wju7h45pYmd4TV0t0ZPUOIP9HonfB2BvEfLZZfMcHcEN
+QkVAmqpO2td7M7B8e6zo5+URZ0RVasuoTFlMwNcvzPCt5XdfxY/WMH9FAzJ5Kbdo
+U7Vte4WMyTsS8msfIMUwn9hH7xtwoNz9CSQ/vFcCDb+zANG18TC2uNXzjYNoFzib
+yYeoSMY2wtd2cz2GxD4=
+=2qVX
+-----END PGP SIGNATURE-----

dovecot-2.3.10.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:473184723d854a4d1dbd99c11a7b9f65156ca5fe6ecf85d9a44b5127e6f871c5
-size 7222241

dovecot-2.3.10.tar.gz.sig

@@ -1,17 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQJLBAABCAA1FiEEK+dKqz7nVN+5yA0zGKNIru1AnaEFAl5iGhcXHGRvdmVjb3Qt
-Y2VAZG92ZWNvdC5vcmcACgkQGKNIru1AnaG8kw//S73W3/HVISbRzIS78lyaeJmC
-aRnbjbJ+RGbaUy1LG9vP7wWyYcpGGbApnizeecpkZN/vWgFkmobvOS5rdSP0ITUZ
-7VG3nG1IfKpkpGqffDNKCSkMblF5LZ9BGa948seplyKi1uRWtK8oUl95Has9RyqJ
-P7z+dl2RJPjJiK1e9tYIr6Y9bRR8EcZJlzOr7a8gDKiI6ugeqzds7aiLwiW6f5wL
-fOKjKgExTxZeRJF0inOGaYEhx4M5g5NAn6y7OuUYqXdPcTW5mRDq3mDmftmtdAJZ
-RMxJ1ATr01iWo/3wcORHMqCqlR8HzaGPs75rpZolxWrYtVIFPS5RIqFhG7IcbrT7
-101jEHsacx9TtzkL9z6Rm3qHsfiSqeSyE7J+4nj2Dbe88JxsXm8L6JgwPxuA9qzg
-CKvqbwaS0YssP1X0DpxJd2IYzxhGsC6bR9vEIui6N88Aeda17dLHymCdS4Idy5FE
-UqIPJOu2u57Nr6yIeRsYDtbuQUOOFu9RjKBefyWTK9CkibtVsPbtcoHIJl5wSWMA
-4SByZMW5YibeMEjv4Q9bAFUAZz/z74n8nXuYJzHnpbLllO5RL7prY+jCh4C3+tUH
-abr3Ze9F8kAl2NEb3EL/mJtTvr+xdQRdk5UD6pghDFhjkXhWCG0nydX4Om7YnSrl
-PxBREzaF+0V81+2dC34=
-=k0ms
------END PGP SIGNATURE-----

dovecot23.changes

@@ -1,3 +1,16 @@
+-------------------------------------------------------------------
+Mon May 18 14:04:52 UTC 2020 - Michael Ströder <michael@stroeder.com>
+
+- update to 2.3.10.1 with security fixes for
+  * CVE-2020-10957: lmtp/submission: A client can crash the server by
+    sending a NOOP command with an invalid string parameter.
+  * CVE-2020-10958: lmtp/submission: Sending many invalid or unknown
+    commands can cause the server to access freed memory, which can lead
+    to a server crash.
+  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
+    address that has the empty quoted string as local-part causes the
+    lmtp service to crash.
+
 -------------------------------------------------------------------
 Wed Apr 29 21:25:30 UTC 2020 - Marcus Rueckert <mrueckert@suse.de>
 

dovecot23.spec

@@ -19,10 +19,10 @@
 %global _lto_cflags %{nil}
 
 Name:           dovecot23
-Version:        2.3.10
+Version:        2.3.10.1
 Release:        0
 %define pkg_name dovecot
-%define dovecot_version 2.3.10
+%define dovecot_version 2.3.10.1
 %define dovecot_pigeonhole_version 0.5.10
 %define dovecot_branch  2.3
 %define dovecot_pigeonhole_source_dir %{pkg_name}-%{dovecot_branch}-pigeonhole-%{dovecot_pigeonhole_version}