- dovecot (1:2.4.3+dfsg1-2+rpi1) forky-staging; urgency=medium
++dovecot (1:2.4.5+dfsg1-2+rpi1) forky-staging; urgency=medium
+
+ [changes brought forward from 1:2.3.21+dfsg1-3+rpi1 by Peter Michael Green <plugwash@raspbian.org> at Thu, 20 Jun 2024 17:16:27 +0000]
+ * Disablte testsuite.
+
- -- Raspbian forward porter <root@raspbian.org> Sat, 18 Apr 2026 18:33:51 +0000
++ -- Raspbian forward porter <root@raspbian.org> Thu, 10 Sep 2026 00:19:16 +0000
++
+ dovecot (1:2.4.5+dfsg1-2) unstable; urgency=medium
+
+ * [8b432dd] lib: xxh64: fix byte ordering issue on big-endian systems
+ (Closes: #1146449)
+ * [45b5e14] Fix loong64 ftbfs (Closes: #1146490)
+
+ -- Noah Meyerhans <noahm@debian.org> Wed, 02 Sep 2026 12:17:57 -0400
+
+ dovecot (1:2.4.5+dfsg1-1) unstable; urgency=medium
+
+ * [e470328] New upstream version 2.4.5+dfsg1 (Closes: #1146018)
+ - https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html
+ - CVE-2026-27852 - DoS by sending mail with bad header.
+ - CVE-2026-33263 - submission-login: Panic when
+ mail_max_userip_connections is reached
+ - CVE-2026-33604 - SMTP Smuggling via Missing Dot-Stuffing After Bare
+ Carriage Return.
+ - CVE-2026-33605 - managesieve-login: Pre-auth crash.
+ - CVE-2026-33606 - dsync: Mail content can cause dsync protocol
+ injection.
+ - CVE-2026-33607 - Dovecot IMAP LIST match_sub() Exponential
+ Backtracking - CPU Denial of Service.
+ - CVE-2026-40013 - pigeonhole: Stack Buffer Underflow in Pigeonhole
+ ManageSieve CHECKSCRIPT/PUTSCRIPT.
+ - CVE-2026-40014 - Whenever a mail client issues a THREAD command on
+ the affected mailbox, this can cause degradation or denial of
+ service for IMAP.
+ - CVE-2026-40015 - An attacker that has valid credentials can open
+ many connections to the imap-hibernate service and send invalid
+ commands, which can intermittently cause an out-of-bounds read and
+ crash the process.
+ - CVE-2026-40017 - IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision
+ in strmap
+ - CVE-2026-40018 - MySQL multi-byte escaping wrong.
+ - CVE-2026-40019 - v2.4.3 regression: managesieve-login pre-auth
+ infinite loop.
+ - CVE-2026-40203 - IMAP Compression Can Reveal Whether a Small Synced
+ Email Body Matches Sender-Chosen Text.
+ - CVE-2026-40204 - acl: lda_mailbox_autocreate can bypass acl
+ restrictions.
+ - CVE-2026-40205 - OAuth2 passdb scope enforcement bypass via OR
+ semantics in remote validation path
+ - CVE-2026-42007 - Sieve editheader RCE. An attacker that has valid
+ credentials can use a Sieve script with the editheader extension to
+ trigger a use-after-free in the mail editing code, and to write
+ memory contents beyond the intended buffer into the delivered mail.
+ - CVE-2026-42008 - XCLIENT FORWARD= bare token not namespaced, allows
+ nopassword injection via trusted proxy.
+ - CVE-2026-42391 - imap: Pre-login memory/CPU growth with ID command.
+ - CVE-2026-42392 - imap-urlauth leaks memory into user-visible error
+ messages.
+ - CVE-2026-42393 - doveadm_password or api key length can still be
+ leaked with timing comparisons.
+ - CVE-2026-42395 - Single NUL-Byte XCLIENT FORWARD Payload Crashes. A
+ host listed as a trusted proxy can send forwarding information
+ containing a NUL byte, which crashes the login process on the
+ following login attempt.
+ - CVE-2026-52681 - Sieve resource usage tracking lost when active
+ script changes.
+ - CVE-2026-52687 - IMAP: COMPRESS ZSTD can cause excessive memory
+ usage.
+ - CVE-2026-73208 - auth: db-oauth2: aud claim used as fallback for
+ missing scope claim.
+ - CVE-2026-73209 - imap-login crash: Self-recursion on zero-output
+ decompress chunks.
+ * [0f045ed] refresh patches
+ * [43cc0a0] d/copyright: reflect upstream's removal of src/lib-otp
+ * [e781a92] update dovecot-mysql transitional package metadata
+
+ -- Noah Meyerhans <noahm@debian.org> Mon, 31 Aug 2026 15:19:46 -0400
+
+ dovecot (1:2.4.4+dfsg1-2) unstable; urgency=medium
+
+ [ Noah Meyerhans ]
+ * [d8ee54a] Add rpmsvc-proto to build-depends (Closes: #1130117)
+ * [a5aa505] replace dovecot-mysql with dovecot-mariadb (Closes: #1137297)
+ * [fc77cc8] add an autopkgtest for gssapi
+ * [b41535d] remove /etc/dovecot/private dpkg-statoverride on purge
+ (Closes: #1139630)
+
+ [ Florian Best ]
+ * [6c605dd] docs(conf): fix references to new placeholder format
+ * [0896294] docs(conf): remove trailing whitespace
+ * [03417d4] docs(conf): fix documentation about boolean plugin configuration
+
+ -- Noah Meyerhans <noahm@debian.org> Thu, 30 Jul 2026 15:13:37 -0400
+
+ dovecot (1:2.4.4+dfsg1-1) unstable; urgency=medium
+
+ [ Luca Boccassi ]
+ * [6261bfd] Install and use sysusers.d config file
+
+ [ Noah Meyerhans ]
+ * [9a7a738] Add tests for bug 1134464 regression
+ * [6f1a08b] remove unreproducible TEST_DIR in dovecot-config
+ * [185a225] New upstream version 2.4.4+dfsg1
+ - CVE-2026-27851: lib-var-expand: Safe filter leaks to all following pipelines
+ - CVE-2026-40016: Sieve :contains/:matches O(N×M) Substring Match Bypasses
+ sieve_max_cpu_time Limit (130× Overrun)
+ - CVE-2026-33603: login: Base64 input can contain tabs that bypass IPC
+ protection
+ - CVE-2026-40020: IMAP folders can be shared-spammed to everyone
+ - CVE-2026-42006: imap-login: Excessive memory usage DoS
+ (Closes: #1136444)
+ * [a6c0328] settings: Use correct symbol STORAGE_LDAP in settings-get.pl
+ * [874cea7] refresh patches
+ * [a4af2a3] Fix test failures on 32-bit systems
+
+ -- Noah Meyerhans <noahm@debian.org> Thu, 14 May 2026 13:29:38 -0400
dovecot (1:2.4.3+dfsg1-2) unstable; urgency=medium
projects / dovecot.git / commitdiff