pool/dovecot23
SHA256
11
0
Fork 1
Code Issues Pull Requests Activity

- update to 2.3.0.1

Browse Source 
* CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames.
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process.
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop

OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=6
This commit is contained in:
Marcus Rückert
2018-03-06 13:53:55 +00:00
committed by Git OBS Bridge
parent 4ea5f55590
commit 355adda1ff
4 changed files with 34 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
dovecot-2.3.0.1.tar.gz Normal file
View File

@@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:ab772b3e214683aba347203c9391295552255c4d69afb324c7b8c8fc5ad6f153
size 6499984

3
dovecot-2.3.0.tar.gz
View File

@@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:de60cb470d025e4dd0f8e8fbbb4b9316dfd4930eb949d307330669ffbeaf8581
size 6635541

26
dovecot23.changes
View File

@@ -1,3 +1,29 @@
-------------------------------------------------------------------
Tue Mar 6 13:48:50 UTC 2018 - mrueckert@suse.de
- update to 2.3.0.1
* CVE-2017-15130: TLS SNI config lookups may lead to excessive
memory usage, causing imap-login/pop3-login VSZ limit to be
reached and the process restarted. This happens only if Dovecot
config has local_name { } or local { } configuration blocks and
attacker uses randomly generated SNI servernames.
* CVE-2017-14461: Parsing invalid email addresses may cause a
crash or leak memory contents to attacker. For example, these
memory contents might contain parts of an email from another
user if the same imap process is reused for multiple users.
First discovered by Aleksandar Nikolic of Cisco Talos.
Independently also discovered by "flxflndy" via HackerOne.
* CVE-2017-15132: Aborted SASL authentication leaks memory in
login process.
* Linux: Core dumping is no longer enabled by default via
PR_SET_DUMPABLE, because this may allow attackers to bypass
chroot/group restrictions. Found by cPanel Security Team.
Nowadays core dumps can be safely enabled by using "sysctl -w
fs.suid_dumpable=2". If the old behaviour is wanted, it can
still be enabled by setting:
import_environment=$import_environment PR_SET_DUMPABLE=1
- imap-login with SSL/TLS connections may end up in infinite loop
-------------------------------------------------------------------
Mon Dec 25 22:39:53 UTC 2017 - jengelh@inai.de

10
dovecot23.spec
View File

@@ -1,7 +1,7 @@
#
# spec file for package dovecot22
# spec file for package dovecot23
#
# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -17,10 +17,10 @@
Name: dovecot23
Version: 2.3.0
Version: 2.3.0.1
Release: 0
%define pkg_name dovecot
%define dovecot_version 2.3.0
%define dovecot_version 2.3.0.1
%define dovecot_pigeonhole_version 0.5.0
%define dovecot_branch 2.3
%define dovecot_pigeonhole_source_dir %{pkg_name}-%{dovecot_branch}-pigeonhole-%{dovecot_pigeonhole_version}
@@ -310,7 +310,7 @@ This package holds the file needed to compile plugins outside of the
dovecot tree.
%prep
%setup -q -n %{pkg_name}-ce-%{dovecot_version} -a 1
%setup -q -n %{pkg_name}-%{dovecot_version} -a 1
%patch -p1
%patch1 -p1
pushd %{dovecot_pigeonhole_source_dir}