ff7b3d5db3
Dovecot 2.3.21.1
- CVE-2024-23184: A large number of address headers in email resulted
in excessive CPU usage. [boo#1229184]
- CVE-2024-23185: Abnormally large email headers are now truncated or
discarded, with a limit of 10MB on a single header and 50MB for all
the headers of all the parts of an email. [boo#1229183]
- oauth2: Dovecot would send client_id and client_secret as POST parameters
to introspection server. These need to be optionally in Basic auth
instead as required by OIDC specification.
- oauth2: JWT key type check was too strict.
- oauth2: JWT token audience was not validated against client_id as
required by OIDC specification.
- oauth2: XOAUTH2 and OAUTHBEARER mechanisms were not giving out
protocol specific error message on all errors. This broke OIDC discovery.
- oauth2: JWT aud validation was not performed if aud was missing
from token, but was configured on Dovecot.
OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=121
35 lines
1.1 KiB
Diff
35 lines
1.1 KiB
Diff
diff -up dovecot-2.3.14/src/lib-dcrypt/dcrypt-openssl.c.opensslv3 dovecot-2.3.14/src/lib-dcrypt/dcrypt-openssl.c
|
|
--- dovecot-2.3.14/src/lib-dcrypt/dcrypt-openssl.c.opensslv3 2021-06-03 18:56:52.573174433 +0200
|
|
+++ dovecot-2.3.14/src/lib-dcrypt/dcrypt-openssl.c 2021-06-03 18:56:52.585174274 +0200
|
|
@@ -73,10 +73,30 @@
|
|
2<tab>key algo oid<tab>1<tab>symmetric algo name<tab>salt<tab>hash algo<tab>rounds<tab>E(RSA = i2d_PrivateKey, EC=Private Point)<tab>key id
|
|
**/
|
|
|
|
+#if OPENSSL_VERSION_MAJOR == 3
|
|
+static EC_KEY *EVP_PKEY_get0_EC_KEYv3(EVP_PKEY *key)
|
|
+{
|
|
+ EC_KEY *eck = EVP_PKEY_get1_EC_KEY(key);
|
|
+ EVP_PKEY_set1_EC_KEY(key, eck);
|
|
+ EC_KEY_free(eck);
|
|
+ return eck;
|
|
+}
|
|
+
|
|
+static EC_KEY *EVP_PKEY_get1_EC_KEYv3(EVP_PKEY *key)
|
|
+{
|
|
+ EC_KEY *eck = EVP_PKEY_get1_EC_KEY(key);
|
|
+ EVP_PKEY_set1_EC_KEY(key, eck);
|
|
+ return eck;
|
|
+}
|
|
+
|
|
+#define EVP_PKEY_get0_EC_KEY EVP_PKEY_get0_EC_KEYv3
|
|
+#define EVP_PKEY_get1_EC_KEY EVP_PKEY_get1_EC_KEYv3
|
|
+#else
|
|
#ifndef HAVE_EVP_PKEY_get0
|
|
#define EVP_PKEY_get0_EC_KEY(x) x->pkey.ec
|
|
#define EVP_PKEY_get0_RSA(x) x->pkey.rsa
|
|
#endif
|
|
+#endif
|
|
|
|
#ifndef HAVE_OBJ_LENGTH
|
|
#define OBJ_length(o) ((o)->length)
|