ff7b3d5db3
Dovecot 2.3.21.1
- CVE-2024-23184: A large number of address headers in email resulted
in excessive CPU usage. [boo#1229184]
- CVE-2024-23185: Abnormally large email headers are now truncated or
discarded, with a limit of 10MB on a single header and 50MB for all
the headers of all the parts of an email. [boo#1229183]
- oauth2: Dovecot would send client_id and client_secret as POST parameters
to introspection server. These need to be optionally in Basic auth
instead as required by OIDC specification.
- oauth2: JWT key type check was too strict.
- oauth2: JWT token audience was not validated against client_id as
required by OIDC specification.
- oauth2: XOAUTH2 and OAUTHBEARER mechanisms were not giving out
protocol specific error message on all errors. This broke OIDC discovery.
- oauth2: JWT aud validation was not performed if aud was missing
from token, but was configured on Dovecot.
OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=121
18 lines
866 B
Standard ML
18 lines
866 B
Standard ML
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQJLBAABCgA1FiEEK+dKqz7nVN+5yA0zGKNIru1AnaEFAma8fsIXHGRvdmVjb3Qt
|
|
Y2VAZG92ZWNvdC5vcmcACgkQGKNIru1AnaFbpA//Tdg+pLQsXCMQx6oVtk0QN/MX
|
|
838FRT/fJZZtyCz+ldiTfCdYBxOk5FHhFHaMZV4ibZBCSmQVxr2SOAb0yEWXXort
|
|
50XC2T0J5XOxgBuQI0Q4ltOzl++ghExYmp+aAO7I5XjWOOn4g+nOguQdmTvVbOq4
|
|
JwIgtnK9iK/6/phMgu0bdd5SGOJsjoRsw5mBM0/CkZ0kJ9RzSKJ6mZc7g6KdZLRF
|
|
8o+fBq/Ioo5snPNCsWx8Ms6T7hg/TTxyc2g+4PF7jMcn2zPhpWiQ3v/nGmhppPsE
|
|
Wz2+/folqP0avgG2McGPDUXDV9D7EhVnZ87julZd+HAAAPMi7duxc6Ow2/8FvJBW
|
|
xvtNjXs7hwUxp0kpn5JfAAohljVABzDIQgNptmr5VKA4jYtIf02F3rwfWIUaRrpl
|
|
xnFrIWOU7+6ED7ylQew5TuUBjguQBrt0O6ppu0o2f3R0LkFelVWJfG0H5EH0HN9v
|
|
1+91JYdbmUOVphRXfXH5qi1BSuYR267O8zg5mA/22jti0TJ+rrWUy5FVv1SVTlh2
|
|
VBYhK2VYayUaEttzwmUTQkgbLWA7RcPLVpqCS/FlgJAwiskxiwJCxe9gZxf+qVVk
|
|
CZOmquC26UiGXATlhmf5k8UOHBsnVCBnRzuE9w15wXUIs4OCIhNiPOct710+RcfZ
|
|
mXkDwgI2e0uXwun3Qt8=
|
|
=6oIY
|
|
-----END PGP SIGNATURE-----
|