9313a0925fAccepting request 1225498 from server:mail
factory
Ana Guerrero
2024-11-21 14:19:14 +0000
8a0ba165a4- Add dovecot-link-icu76.patch: configure: Explicitly check for icu-uc Ensure we link against libicu-uc when it's split in v76 (boo#1233582). - Call autoreconf in build section, as above patch touches the build system.
devel
Marcus Rueckert2024-11-21 09:30:10 +0000
d84d61e74fAccepting request 1194886 from server:mail
Ana Guerrero
2024-08-20 14:15:09 +0000
ff7b3d5db3- update to 2.3.21.1 and pigeonhole 0.5.21.1 Dovecot 2.3.21.1 - CVE-2024-23184: A large number of address headers in email resulted in excessive CPU usage. [boo#1229184] - CVE-2024-23185: Abnormally large email headers are now truncated or discarded, with a limit of 10MB on a single header and 50MB for all the headers of all the parts of an email. [boo#1229183] - oauth2: Dovecot would send client_id and client_secret as POST parameters to introspection server. These need to be optionally in Basic auth instead as required by OIDC specification. - oauth2: JWT key type check was too strict. - oauth2: JWT token audience was not validated against client_id as required by OIDC specification. - oauth2: XOAUTH2 and OAUTHBEARER mechanisms were not giving out protocol specific error message on all errors. This broke OIDC discovery. - oauth2: JWT aud validation was not performed if aud was missing from token, but was configured on Dovecot.
Peter Varkoly
2024-08-20 10:30:04 +0000
fcefb90a43Accepting request 1123902 from server:mail
Ana Guerrero
2023-11-07 20:27:29 +0000
7e3b60358fAccepting request 1123622 from home:dimstar:FactoryDirk Mueller2023-11-07 10:31:30 +0000
4aba1d61aaAccepting request 1111576 from server:mail
Ana Guerrero
2023-09-15 20:05:55 +0000
f739a90376Accepting request 1111575 from home:adkorte:branches:server:mailMarcus Rueckert2023-09-15 14:23:31 +0000
a08d42cae4Accepting request 1075272 from home:marxin:branches:server:mailMarcus Rueckert2023-03-29 14:27:17 +0000
e109a95089Accepting request 1074626 from server:mail
Dominique Leuenberger
2023-03-27 16:17:25 +0000
011563c0e6Accepting request 1074621 from home:marxin:branches:server:mailMarcus Rueckert2023-03-27 09:34:43 +0000
4fb268d6efAccepting request 1063605 from server:mail
Dominique Leuenberger
2023-02-07 17:50:04 +0000
bd41626afbAccepting request 1063508 from home:adkorte:branches:server:mail
Dirk Stoecker
2023-02-07 10:24:58 +0000
f1d3b5b296Accepting request 1045048 from server:mail
Dominique Leuenberger
2022-12-24 13:52:04 +0000
e26b83b3e6Accepting request 1044344 from home:stroeder:networkDirk Mueller2022-12-23 16:13:10 +0000
c88eb3067eAccepting request 1044022 from server:mail
Dominique Leuenberger
2022-12-21 15:07:08 +0000
d3b7eeff46Accepting request 1043991 from home:thiagomacieiraDirk Mueller2022-12-21 07:28:56 +0000
522a0c3bf8Accepting request 984208 from server:mail
Dominique Leuenberger
2022-06-23 08:23:26 +0000
aca9b3f546Accepting request 982632 from home:stroeder:networkMarcus Rueckert2022-06-15 09:21:59 +0000
53f96e344eAccepting request 976134 from server:mail
Dominique Leuenberger
2022-05-12 20:58:26 +0000
1ee2e837aeAccepting request 976125 from home:adkorte:branches:server:mail
Christian Wittmer
2022-05-10 20:18:42 +0000
a6a8fdfb9dAccepting request 953336 from server:mail
Dominique Leuenberger
2022-02-11 22:07:41 +0000
78d92b0077Accepting request 951413 from home:stroeder:networkMarcus Rueckert2022-02-04 01:43:45 +0000
bddef8057bAccepting request 951384 from server:mail
Dominique Leuenberger
2022-02-03 22:16:52 +0000
27be5ff268Accepting request 951326 from home:dimstar:FactoryDirk Mueller2022-02-03 21:00:58 +0000
c70acd27d4Accepting request 950732 from home:dimstar:FactoryDirk Mueller2022-02-03 12:40:28 +0000
04cc9f5df1Accepting request 940834 from server:mail
Dominique Leuenberger
2021-12-16 08:58:03 +0000
958249c91dAccepting request 940830 from home:favogt:branches:server:mail
Peter Varkoly
2021-12-16 08:56:12 +0000
12ede5efbeAccepting request 940573 from server:mail
Dominique Leuenberger
2021-12-14 21:02:24 +0000
5c9be102f7Accepting request 936363 from home:stroeder:networkMarcus Rueckert2021-12-08 02:44:45 +0000
a16673cbb7Accepting request 912378 from server:mail
Richard Brown
2021-08-18 06:55:53 +0000
e60385e579Accepting request 911327 from home:stroeder:networkMarcus Rueckert2021-08-16 09:39:47 +0000
4c1e9c558bAccepting request 903106 from server:mail
Dominique Leuenberger
2021-07-07 16:29:57 +0000
c69466d490Accepting request 832820 from server:mail
Dominique Leuenberger
2020-09-08 20:48:59 +0000
42ae3bc819- libsodium is not strictly required, it is only required for the argon password scheme. This is now no longer supported on sle12Marcus Rueckert2020-08-31 15:27:50 +0000
bdd2881250Accepting request 826276 from server:mail
Dominique Leuenberger
2020-08-14 07:33:47 +0000
2cb5006e53- update to 2.3.7.2 * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - update pigeonhole to 0.5.7.2 * CVE-2019-11500: ManageSieve protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - refreshed patches to apply cleanly again: dovecot-2.3.0-better_ssl_defaults.patch dovecot-2.3.0-dont_use_etc_ssl_certs.patchMarcus Rueckert2019-08-28 17:07:06 +0000
937581144bAccepting request 718437 from server:mail
Dominique Leuenberger
2019-07-26 10:40:22 +0000
b0eea71fbbAccepting request 718004 from home:stroeder:branches:server:mailMarcus Rueckert2019-07-24 13:30:23 +0000
9777cde63eAccepting request 704275 from home:varkoly:branches:server:mail
Lars Vogdt
2019-06-17 05:44:13 +0000
1f4f8d23fcAccepting request 699690 from server:mail
Dominique Leuenberger
2019-05-02 17:18:31 +0000
6686f19e4a- update pigeonhole to 0.5.6 + sieve: Redirect loop prevention is sometimes ineffective. Improve existing loop detection by also recognizing the X-Sieve-Redirected-From header in incoming messages and dropping redirect actions when it points to the sending account. This header is already added by the redirect action, so this improvement only adds an additional use of this header. - sieve: Prevent execution of implicit keep upon temporary failure occurring at runtime.Marcus Rueckert2019-04-30 13:50:19 +0000
1f53965469- update to 2.3.6: (boo#1133624 boo#1133625) * CVE-2019-11494: Submission-login crashed with signal 11 due to null pointer access when authentication was aborted by disconnecting. * CVE-2019-11499: Submission-login crashed when authentication was started over TLS secured channel and invalid authentication message was sent. * auth: Support password grant with passdb oauth2. + Use system default CAs for outbound TLS connections. + Simplify array handling with new helper macros. + fts_solr: Enable configuring batch_size and soft_commit features. - lmtp/submission: Fixed various bugs in XCLIENT handling, including a hang when XCLIENT commands were sent infinitely to the remote server. - lmtp/submission: Forwarded multi-line replies were erroneously sent as two replies to the client. - lib-smtp: client: Message was not guaranteed to contain CRLF consistently when CHUNKING was used. - fts_solr: Plugin was no longer compatible with Solr 7. - Make it possible to disable certificate checking without setting ssl_client_ca_* settings. - pop3c: SSL support was broken. - mysql: Closing connection twice lead to crash on some systems. - auth: Multiple oauth2 passdbs crashed auth process on deinit. - HTTP client connection errors infrequently triggered a segmentation fault when the connection was idle and not used for a particular client instance. - drop https://github.com/dovecot/core/commit/3c5101ffd.patchMarcus Rueckert2019-04-30 13:41:27 +0000
8d2188ca9aAccepting request 695556 from server:mail
Dominique Leuenberger
2019-04-19 16:38:42 +0000
6e450a619d- update to 2.3.5.2 (boo#1132501) * CVE-2019-10691: Trying to login with 8bit username containing invalid UTF8 input causes auth process to crash if auth policy is enabled. This could be used rather easily to cause a DoS. Similar crash also happens during mail delivery when using invalid UTF8 in From or Subject header when OX push notification driver is used. - update to 2.3.5.1 (boo#1130116)Marcus Rueckert2019-04-18 11:49:39 +0000
bd6ab02f8eAccepting request 689340 from server:mail
Dominique Leuenberger
2019-04-04 13:22:16 +0000
5865d4af03- update to 2.3.5.1 * CVE-2019-7524: Missing input buffer size validation leads into arbitrary buffer overflow when reading fts or pop3 uidl header from Dovecot index. Exploiting this requires direct write access to the index files.Marcus Rueckert2019-03-28 12:47:57 +0000
be1de09640Accepting request 671912 from server:mail
Stephan Kulow
2019-02-06 13:07:20 +0000
850a9b2907- update to 2.3.4.1 (boo#1123022) * CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field (ssl_cert_username_field), under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. * ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This bug didn't affect Dovecot's Submission service.Marcus Rueckert2019-02-05 14:50:04 +0000
0283fb7b23Accepting request 667410 from server:mail
Dominique Leuenberger
2019-01-24 13:12:00 +0000
d6d0b37521Accepting request 666836 from home:adkorte:branches:openSUSE:FactoryJan Engelhardt2019-01-21 09:39:59 +0000
b8368d0aabAccepting request 655862 from server:mail
Dominique Leuenberger
2018-12-07 13:38:22 +0000
fbdf7e7877Accepting request 655860 from home:darix:branches:server:mail
Andreas Schneider
2018-12-06 17:41:29 +0000
0fe6e1543bAccepting request 653727 from server:mail
Dominique Leuenberger
2018-12-04 19:57:36 +0000
Ana Guerrero
Marcus Rueckert
Peter Varkoly
Dirk Mueller
Dominique Leuenberger
Dirk Stoecker
Christian Wittmer
Richard Brown
Yuchen Lin
Wolfgang Rosenauer
Lars Vogdt
Stephan Kulow
Jan Engelhardt
Andreas Schneider