[pkgsrc/pkgsrc-2020Q4]: pkgsrc/mail Pullup ticket #6391 - requested by taca

To: pkgsrc-changes-hg%NetBSD.org@localhost
Subject: [pkgsrc/pkgsrc-2020Q4]: pkgsrc/mail Pullup ticket #6391 - requested by taca
From: bsiegert <bsiegert%pkgsrc.org@localhost>
Date: Mon, 04 Jan 2021 19:00:25 +0000
details:   https://anonhg.NetBSD.org/pkgsrc/rev/3f72a58f63b6
branches:  pkgsrc-2020Q4
changeset: 444315:3f72a58f63b6
user:      bsiegert <bsiegert%pkgsrc.org@localhost>
date:      Mon Jan 04 17:34:04 2021 +0000

description:
Pullup ticket #6391 - requested by taca
mail/dovecot2: security fix

Revisions pulled up:
- mail/dovecot2-gssapi/Makefile                                 1.7
- mail/dovecot2-sqlite/Makefile                                 1.25
- mail/dovecot2/Makefile                                        1.106
- mail/dovecot2/Makefile.common                                 1.42
- mail/dovecot2/PLIST                                           1.71
- mail/dovecot2/buildlink3.mk                                   1.36
- mail/dovecot2/distinfo                                        1.107
- mail/dovecot2/patches/patch-src_auth_mech-gssapi.c            deleted

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Mon Jan  4 14:57:19 UTC 2021

   Modified Files:
        pkgsrc/mail/dovecot2: Makefile Makefile.common PLIST buildlink3.mk
            distinfo
        pkgsrc/mail/dovecot2-gssapi: Makefile
        pkgsrc/mail/dovecot2-sqlite: Makefile
   Removed Files:
        pkgsrc/mail/dovecot2/patches: patch-src_auth_mech-gssapi.c

   Log Message:
   mail/dovecot2: update to 2.3.13

   Update mail/dovecot2 pacakge to 2.3.13, including security fixes.

   v2.3.13 2021-01-04   Aki Tuomi <aki.tuomi%open-xchange.com@localhost>

        * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
          allow logged in user to access other people's emails and filesystem
          information.
        * Metric filter and global event filter variable syntax changed to a
          SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
        * auth: Added new aliases for %{variables}. Usage of the old ones is
          possible, but discouraged.
        * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
          mechanism and related password schemes.
        * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
        * auth: Removed postfix postmap socket
        + auth: Added new fields for auth server events. These fields are now
          also available for all auth events. See
          https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
          for details.
        + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
          and imap_client_unhibernate_retried events. See
          https://doc.dovecot.org/admin_manual/list_of_events/ for details.
        + lib-index: Added new mail_index_recreated event. See
          https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
        + lib-sql: Support TLS options for cassandra driver. This requires
          cpp-driver v2.15 (or later) to work reliably.
        + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
          added to existing mails if mail_attachment_detection_option=add-flags
          and it can be done inexpensively.
        + login proxy: Added login_proxy_max_reconnects setting (default 3) to
          control how many reconnections are attempted.
        + login proxy: imap/pop3/submission/managesieve proxying now supports
          reconnection retrying on more than just connect() failure. Any error
          except a non-temporary authentication failure will result in reconnect
          attempts.
        - auth: Lua passdb/userdb leaks stack elements per call, eventually
          causing the stack to become too deep and crashing the auth or
          auth-worker process.
        - auth: SASL authentication PLAIN mechanism could be used to trigger
          read buffer overflow. However, this doesn't seem to be exploitable in
          any way.
        - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
          disallows NUL bytes for it.
        - dict: Process used too much CPU when iterating keys, because each key
          used a separate write() syscall.
        - doveadm-server: Crash could occur if logging was done outside command
          handling. For example http-client could have done debug logging
          afterwards, resulting in either segfault or
          Panic: file http-client.c: line 642 (http_client_context_close):
          assertion failed: (cctx->clients_list == NULL).
        - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
          process via starttls assert-crashed if there were no ssl=yes listeners:
          Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
          assertion failed: (service->ssl_ctx_initialized).
        - fts-solr: HTTP requests may have assert-crashed:
          Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
          assertion failed: (req->payload_input != NULL)
        - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
          configuration that causes errors. Sending the error responses to the
          client can cause the segmentation fault. This can for example happen
          when several namespaces use the same mail storage location.
        - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
          exist (e.g. public namespace for a nonexistent user) can crash with a panic:
          Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
        - imap: IMAP session can crash with QRESYNC extension if many changes
          are done before asking for expunged mails since last sync.
        - imap: Process might hang indefinitely if client disconnects after
          sending some long-running commands pipelined, for example FETCH+LOGOUT.
        - lib-compress: Mitigate crashes when configuring a not compiled in
          compression. Errors with compression configuration now distinguish
          between not supported and unknown.
        - lib-compression: Using xz/lzma compression in v2.3.11 could have
          written truncated output in some situations. This would result in
          "Broken pipe" read errors when trying to read it back.
        - lib-compression: zstd compression could have crashed in some situations:
          Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream->blocking)
        - lib-dict: dict client could have crashed in some rare situations when
          iterating keys.
        - lib-http: Fix several assert-crashes in HTTP client.
        - lib-index: v2.3.11 regression: When mails were expunged at the same
          time as lots of new content was being saved to the cache (e.g. cache
          file was lost and is being re-filled) a deadlock could occur with
          dovecot.index.cache / dovecot.index.log.
        - lib-index: v2.3.11 regression: dovecot.index.cache file was being
          purged (rewritten) too often when it had a field that hadn't been
          accessed for over 1 month, but less than 2 months. Every cache file
          change caused a purging in this situation.
        - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
          Regression caused by fixing CVE-2020-12100.
        - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
          was written in a way that may have caused confusion for both IMAP
          clients and Dovecot itself when parsing it. The truncated part is now
          written out using application/octet-stream MIME type.
        - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
          10000th MIME part was message/rfc822 (or if parent was multipart/digest):
          Panic: file message-parser.c: line 167 (message_part_append):
          assertion failed: (ctx->total_parts_count <= ctx->max_total_mime_parts).
        - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
          reply to contain username with invalid token.
        - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
          deprecated APIs disabled.
        - lib-storage: When mail's size is different from the cached one (in
          dovecot.index.cache or Maildir S=size in the filename), this is
          handled by logging "Cached message size smaller/larger than expected"
          error. However, in some situations this also ended up crashing with:
          Panic: file istream.c: line 315 (i_stream_read_memarea):
          assertion failed: (old_size <= _stream->pos - _stream->skip).
        - lib-storage: v2.3 regression: Copying/moving mails was taking much more
          memory than before. This was mainly visible when copying/moving
          thousands of mails in a single transaction.
        - lib-storage: v2.3.11 regression: Searching messages assert-crashed
          (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
          assertion failed: (ctx->nested_parts_count > 0).
        - lib: Dovecot v2.3 moved signal handlers around in ioloops,
          causing more CPU usage than in v2.2.
        - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
          in error if it happened to be at read boundary. Any NUL characters and
          '\u0000' will now result in parsing error instead of silently
          truncating the data.
        - lmtp, submission: Server may hang if SSL client connection disconnects
          during the delivery. If this happened repeated, it could have ended
          up reaching process_limit and preventing any further lmtp/submission
          deliveries.
        - lmtp: Proxy does not always properly log TLS connection problems as
          errors; in some cases, only a debug message is logged if enabled.
        - lmtp: The LMTP service can hang when commands are pipelined. This can
          particularly occur when one command in the middle of the pipeline fails.
          One example of this occurs for proxied LMTP transactions in which the
          final DATA or BDAT command is pipelined after a failing RCPT command.
        - login-proxy: The login_source_ips setting has no effect, and therefore
          the proxy source IPs are not cycled through as they should be.
        - master: Process was using 100% CPU in some situations when a broken
          service was being throttled.
        - pop3-login: POP3 login would fail with "Input buffer full" if the
          initial response for SASL was too long.
        - stats: Crash would occur when generating openmetrics data for metrics
          using aggregating functions.

diffstat:

 mail/dovecot2-gssapi/Makefile                      |   3 +--
 mail/dovecot2-sqlite/Makefile                      |   3 +--
 mail/dovecot2/Makefile                             |   3 +--
 mail/dovecot2/Makefile.common                      |   6 +++---
 mail/dovecot2/PLIST                                |  10 ++++++----
 mail/dovecot2/buildlink3.mk                        |   4 ++--
 mail/dovecot2/distinfo                             |  11 +++++------
 mail/dovecot2/patches/patch-src_auth_mech-gssapi.c |  16 ----------------
 8 files changed, 19 insertions(+), 37 deletions(-)

diffs (173 lines):

diff -r aa132e898c5f -r 3f72a58f63b6 mail/dovecot2-gssapi/Makefile
--- a/mail/dovecot2-gssapi/Makefile     Mon Jan 04 17:27:43 2021 +0000
+++ b/mail/dovecot2-gssapi/Makefile     Mon Jan 04 17:34:04 2021 +0000
@@ -1,9 +1,8 @@
-# $NetBSD: Makefile,v 1.6 2020/12/03 19:30:01 markd Exp $
+# $NetBSD: Makefile,v 1.6.2.1 2021/01/04 17:34:04 bsiegert Exp $
 
 .include "../../mail/dovecot2/Makefile.common"
 
 PKGNAME=       ${DISTNAME:S/dovecot/dovecot-gssapi/}
-PKGREVISION=   1
 COMMENT+=      (GSSAPI plugin)
 
 CONFIGURE_ARGS+=       --with-gssapi=plugin
diff -r aa132e898c5f -r 3f72a58f63b6 mail/dovecot2-sqlite/Makefile
--- a/mail/dovecot2-sqlite/Makefile     Mon Jan 04 17:27:43 2021 +0000
+++ b/mail/dovecot2-sqlite/Makefile     Mon Jan 04 17:34:04 2021 +0000
@@ -1,6 +1,5 @@
-# $NetBSD: Makefile,v 1.24 2020/11/05 09:08:35 ryoon Exp $
+# $NetBSD: Makefile,v 1.24.2.1 2021/01/04 17:34:04 bsiegert Exp $
 
-PKGREVISION= 1
 .include "../../mail/dovecot2/Makefile.common"
 
 PKGNAME=       ${DISTNAME:S/dovecot/dovecot-sqlite/}
diff -r aa132e898c5f -r 3f72a58f63b6 mail/dovecot2/Makefile
--- a/mail/dovecot2/Makefile    Mon Jan 04 17:27:43 2021 +0000
+++ b/mail/dovecot2/Makefile    Mon Jan 04 17:34:04 2021 +0000
@@ -1,6 +1,5 @@
-# $NetBSD: Makefile,v 1.105 2020/12/04 04:56:00 riastradh Exp $
+# $NetBSD: Makefile,v 1.105.2.1 2021/01/04 17:34:04 bsiegert Exp $
 
-PKGREVISION= 1
 .include "../../mail/dovecot2/Makefile.common"
 
 RCD_SCRIPTS=           dovecot
diff -r aa132e898c5f -r 3f72a58f63b6 mail/dovecot2/Makefile.common
--- a/mail/dovecot2/Makefile.common     Mon Jan 04 17:27:43 2021 +0000
+++ b/mail/dovecot2/Makefile.common     Mon Jan 04 17:34:04 2021 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.41 2020/08/12 15:54:38 taca Exp $
+# $NetBSD: Makefile.common,v 1.41.4.1 2021/01/04 17:34:04 bsiegert Exp $
 #
 # when updating to a new release, update ABI depends in
 # the buildlink3.mk file as well, since the plugins' version
@@ -11,9 +11,9 @@
 # used by mail/dovecot2-pgsql/Makefile
 # used by mail/dovecot2-sqlite/Makefile
 
-DISTNAME=      dovecot-2.3.11.3
+DISTNAME=      dovecot-2.3.13
 CATEGORIES=    mail
-MASTER_SITES=  https://dovecot.org/releases/${PKGVERSION_NOREV:R:R}/
+MASTER_SITES=  https://dovecot.org/releases/${PKGVERSION_NOREV:R}/
 
 MAINTAINER=    adam%NetBSD.org@localhost
 HOMEPAGE=      https://www.dovecot.org/
diff -r aa132e898c5f -r 3f72a58f63b6 mail/dovecot2/PLIST
--- a/mail/dovecot2/PLIST       Mon Jan 04 17:27:43 2021 +0000
+++ b/mail/dovecot2/PLIST       Mon Jan 04 17:34:04 2021 +0000
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.70 2020/08/12 15:54:38 taca Exp $
+@comment $NetBSD: PLIST,v 1.70.4.1 2021/01/04 17:34:04 bsiegert Exp $
 bin/doveadm
 bin/doveconf
 bin/dovecot-sysreport
@@ -99,6 +99,8 @@
 include/dovecot/dsync-ibc.h
 include/dovecot/eacces-error.h
 include/dovecot/env-util.h
+include/dovecot/event-filter-parser.h
+include/dovecot/event-filter-private.h
 include/dovecot/event-filter.h
 include/dovecot/event-log.h
 include/dovecot/execv-const.h
@@ -405,7 +407,7 @@
 include/dovecot/mdbox-storage.h
 include/dovecot/mdbox-sync.h
 include/dovecot/mech-digest-md5-private.h
-include/dovecot/mech-otp-skey-common.h
+include/dovecot/mech-otp-common.h
 include/dovecot/mech-plain-common.h
 include/dovecot/mech-scram.h
 include/dovecot/mech.h
@@ -572,6 +574,7 @@
 include/dovecot/subscription-file.h
 include/dovecot/syslog-util.h
 include/dovecot/test-common.h
+include/dovecot/test-subprocess.h
 include/dovecot/time-util.h
 include/dovecot/unichar.h
 include/dovecot/unix-socket-create.h
@@ -580,7 +583,6 @@
 include/dovecot/uri-util.h
 include/dovecot/userdb-blocking.h
 include/dovecot/userdb-template.h
-include/dovecot/userdb-vpopmail.h
 include/dovecot/userdb.h
 include/dovecot/utc-mktime.h
 include/dovecot/utc-offset.h
@@ -1053,10 +1055,10 @@
 share/examples/dovecot/conf.d/auth-sql.conf.ext
 share/examples/dovecot/conf.d/auth-static.conf.ext
 share/examples/dovecot/conf.d/auth-system.conf.ext
-share/examples/dovecot/conf.d/auth-vpopmail.conf.ext
 share/examples/dovecot/dovecot-dict-auth.conf.ext
 share/examples/dovecot/dovecot-dict-sql.conf.ext
 share/examples/dovecot/dovecot-ldap.conf.ext
+share/examples/dovecot/dovecot-oauth2.conf.ext
 share/examples/dovecot/dovecot-openssl.cnf
 share/examples/dovecot/dovecot-sql.conf.ext
 share/examples/dovecot/dovecot.conf
diff -r aa132e898c5f -r 3f72a58f63b6 mail/dovecot2/buildlink3.mk
--- a/mail/dovecot2/buildlink3.mk       Mon Jan 04 17:27:43 2021 +0000
+++ b/mail/dovecot2/buildlink3.mk       Mon Jan 04 17:34:04 2021 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.35 2020/12/04 04:56:00 riastradh Exp $
+# $NetBSD: buildlink3.mk,v 1.35.2.1 2021/01/04 17:34:04 bsiegert Exp $
 
 BUILDLINK_TREE+=       dovecot
 
@@ -7,7 +7,7 @@
 
 BUILDLINK_API_DEPENDS.dovecot+=                dovecot>=2.2.0
 # must match current package version for plugins to load
-BUILDLINK_ABI_DEPENDS.dovecot+=                dovecot>=2.3.11.3nb1
+BUILDLINK_ABI_DEPENDS.dovecot+=                dovecot>=2.3.13
 BUILDLINK_PKGSRCDIR.dovecot?=          ../../mail/dovecot2
 
 pkgbase:=      dovecot
diff -r aa132e898c5f -r 3f72a58f63b6 mail/dovecot2/distinfo
--- a/mail/dovecot2/distinfo    Mon Jan 04 17:27:43 2021 +0000
+++ b/mail/dovecot2/distinfo    Mon Jan 04 17:34:04 2021 +0000
@@ -1,14 +1,13 @@
-$NetBSD: distinfo,v 1.106 2020/12/03 19:30:00 markd Exp $
+$NetBSD: distinfo,v 1.106.2.1 2021/01/04 17:34:04 bsiegert Exp $
 
-SHA1 (dovecot-2.3.11.3.tar.gz) = 4a094ae503ded8ccea97cc06680fbb2e0f9c3171
-RMD160 (dovecot-2.3.11.3.tar.gz) = c44a9686a24127c95bd7c439e0548bd66481ab4e
-SHA512 (dovecot-2.3.11.3.tar.gz) = d83e52a7faab918a8e6f6257acc5936b81733c10489affd042c3a043cb842db060286cba9978be378e4958e9ac2e60b55ce289d7f3a88df08e7637e4785e23bb
-Size (dovecot-2.3.11.3.tar.gz) = 7353412 bytes
+SHA1 (dovecot-2.3.13.tar.gz) = 252dc597e8c4b4b0c016916415fec0f80be2facb
+RMD160 (dovecot-2.3.13.tar.gz) = 2005b644abe43133070078188c6fa00fbf076e03
+SHA512 (dovecot-2.3.13.tar.gz) = 758a169fba8925637ed18fa7522a6f06c9fe01a1707b1ca0d0a4d8757c578a8e117c91733e8314403839f9a484bbcac71ce3532c82379eb583b480756d556a95
+Size (dovecot-2.3.13.tar.gz) = 7456073 bytes
 SHA1 (patch-aa) = 3af01aa4a8cea1a3fb840b6243a744de77069611
 SHA1 (patch-ab) = 9db15fd853ba47ef4bf04f2adc9ab24f71ee4d1e
 SHA1 (patch-ae) = c795585df9f415ceabb28eec1ff691ee26168d3b
 SHA1 (patch-af) = c066e94dd6593d16eec3e66f5f4d26f021918498
-SHA1 (patch-src_auth_mech-gssapi.c) = 2e5a46cb8c5f1d8fbb4967f18eb49ac6f6cd17d4
 SHA1 (patch-src_imap_imap-client.h) = 1a2bf95ab6af57d88862a1512624bf263f4c2ce7
 SHA1 (patch-src_lib-ldap_ldap-private.h) = 2d5ce32330ad4164cc75f8d209ba499d37ed01fc
 SHA1 (patch-src_lib_connection.h) = c147511f4ff50e4b5a048c3a363f0af90ee4c6ad
diff -r aa132e898c5f -r 3f72a58f63b6 mail/dovecot2/patches/patch-src_auth_mech-gssapi.c
--- a/mail/dovecot2/patches/patch-src_auth_mech-gssapi.c        Mon Jan 04 17:27:43 2021 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,16 +0,0 @@
-$NetBSD: patch-src_auth_mech-gssapi.c,v 1.1 2020/12/03 19:30:00 markd Exp $
-
-mech-gssapi - GSSAPI can contain NUL.
-dovecot commit fea1bacab954d2f112da8a95756f198530e274af
-
---- src/auth/mech-gssapi.c.orig        2020-08-12 12:20:41.000000000 +0000
-+++ src/auth/mech-gssapi.c
-@@ -735,7 +735,7 @@ mech_gssapi_auth_free(struct auth_reques
- const struct mech_module mech_gssapi = {
-       "GSSAPI",
- 
--      .flags = 0,
-+      .flags = MECH_SEC_ALLOW_NULS,
-       .passdb_need = MECH_PASSDB_NEED_NOTHING,
- 
-       mech_gssapi_auth_new,
Prev by Date: [pkgsrc/pkgsrc-2020Q4]: pkgsrc/doc Pullup tickets up to #6392
Next by Date: [pkgsrc/trunk]: pkgsrc/doc doc: Updated print/poppler to 21.01.0
Previous by Thread: [pkgsrc/pkgsrc-2020Q4]: pkgsrc/doc Pullup tickets up to #6392
Next by Thread: [pkgsrc/trunk]: pkgsrc/doc doc: Updated print/poppler to 21.01.0
Indexes:
Home | Main Index | Thread Index | Old Index