rpm/dovecot23
SHA256
1
0
Fork 0
forked from pool/dovecot23
Code Pull Requests Activity
66ae4aab60
dovecot23/dovecot-2.3.0-better_ssl_defaults.patch

50 lines
2.5 KiB
Diff
Raw Normal View History

- update to 2.3.7.2 * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - update pigeonhole to 0.5.7.2 * CVE-2019-11500: ManageSieve protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - refreshed patches to apply cleanly again: dovecot-2.3.0-better_ssl_defaults.patch dovecot-2.3.0-dont_use_etc_ssl_certs.patch OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=52
2019-08-28 19:07:06 +02:00
Index: dovecot-2.3.7.2/doc/example-config/conf.d/10-ssl.conf
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
===================================================================
- update to 2.3.7.2 * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - update pigeonhole to 0.5.7.2 * CVE-2019-11500: ManageSieve protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - refreshed patches to apply cleanly again: dovecot-2.3.0-better_ssl_defaults.patch dovecot-2.3.0-dont_use_etc_ssl_certs.patch OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=52
2019-08-28 19:07:06 +02:00
--- dovecot-2.3.7.2.orig/doc/example-config/conf.d/10-ssl.conf
+++ dovecot-2.3.7.2/doc/example-config/conf.d/10-ssl.conf
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
@@ -9,8 +9,8 @@
# dropping root privileges, so keep the key file unreadable by anyone but
# root. Included doc/mkcert.sh can be used to easily generate self-signed
# certificate, just make sure to update the domains in dovecot-openssl.cnf
-ssl_cert = </etc/ssl/private/dovecot.crt
-ssl_key = </etc/ssl/private/dovecot.pem
+#ssl_cert = </etc/ssl/private/dovecot.crt
+#ssl_key = </etc/ssl/private/dovecot.pem
# If key file is password protected, give the password here. Alternatively
# give it when starting dovecot with -p parameter. Since this file is often
- update to 2.3.7.2 * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - update pigeonhole to 0.5.7.2 * CVE-2019-11500: ManageSieve protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - refreshed patches to apply cleanly again: dovecot-2.3.0-better_ssl_defaults.patch dovecot-2.3.0-dont_use_etc_ssl_certs.patch OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=52
2019-08-28 19:07:06 +02:00
@@ -60,6 +60,7 @@ ssl_key = </etc/ssl/private/dovecot.pem
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
#ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
# To disable non-EC DH, use:
#ssl_cipher_list = ALL:!DH:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
+ssl_cipher_list = ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
# Colon separated list of elliptic curves to use. Empty value (the default)
# means use the defaults from the SSL library. P-521:P-384:P-256 would be an
- update to 2.3.7.2 * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - update pigeonhole to 0.5.7.2 * CVE-2019-11500: ManageSieve protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - refreshed patches to apply cleanly again: dovecot-2.3.0-better_ssl_defaults.patch dovecot-2.3.0-dont_use_etc_ssl_certs.patch OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=52
2019-08-28 19:07:06 +02:00
@@ -68,6 +69,7 @@ ssl_key = </etc/ssl/private/dovecot.pem
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
# Prefer the server's order of ciphers over client's.
#ssl_prefer_server_ciphers = no
+ssl_prefer_server_ciphers = yes
# SSL crypto device to use, for valid values run "openssl engine"
#ssl_crypto_device =
- update to 2.3.7.2 * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - update pigeonhole to 0.5.7.2 * CVE-2019-11500: ManageSieve protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - refreshed patches to apply cleanly again: dovecot-2.3.0-better_ssl_defaults.patch dovecot-2.3.0-dont_use_etc_ssl_certs.patch OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=52
2019-08-28 19:07:06 +02:00
@@ -76,3 +78,4 @@ ssl_key = </etc/ssl/private/dovecot.pem
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
# compression - Enable compression.
# no_ticket - Disable SSL session tickets.
#ssl_options =
+ssl_options = no_compression
- update to 2.3.7.2 * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - update pigeonhole to 0.5.7.2 * CVE-2019-11500: ManageSieve protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - refreshed patches to apply cleanly again: dovecot-2.3.0-better_ssl_defaults.patch dovecot-2.3.0-dont_use_etc_ssl_certs.patch OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=52
2019-08-28 19:07:06 +02:00
Index: dovecot-2.3.7.2/src/lib-master/master-service-ssl-settings.c
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
===================================================================
- update to 2.3.7.2 * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - update pigeonhole to 0.5.7.2 * CVE-2019-11500: ManageSieve protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. - refreshed patches to apply cleanly again: dovecot-2.3.0-better_ssl_defaults.patch dovecot-2.3.0-dont_use_etc_ssl_certs.patch OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=52
2019-08-28 19:07:06 +02:00
--- dovecot-2.3.7.2.orig/src/lib-master/master-service-ssl-settings.c
+++ dovecot-2.3.7.2/src/lib-master/master-service-ssl-settings.c
@@ -61,7 +61,7 @@ static const struct master_service_ssl_s
- update to 2.3.2 and pigeonhole to 0.5.2 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=22
2018-06-30 22:12:10 +02:00
.ssl_client_cert = "",
.ssl_client_key = "",
Accepting request 559675 from home:darix:playground new package of 2.3.0 OBS-URL: https://build.opensuse.org/request/show/559675 OBS-URL: https://build.opensuse.org/package/show/server:mail/dovecot23?expand=0&rev=1
2017-12-24 03:20:56 +01:00
.ssl_dh = "",
- .ssl_cipher_list = "ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH",
+ .ssl_cipher_list = "ALL:!LOW:!SSLv2:!EXP:!aNULL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH",
.ssl_curve_list = "",
.ssl_min_protocol = "TLSv1",
.ssl_cert_username_field = "commonName",
Copy Permalink