From: Raspbian automatic forward porter Date: Thu, 10 Sep 2026 00:19:16 +0000 (+0100) Subject: Merge version 1:2.4.3+dfsg1-2+rpi1 and 1:2.4.5+dfsg1-2 to produce 1:2.4.5+dfsg1-2... X-Git-Tag: archive/raspbian/1%2.4.5+dfsg1-2+rpi1^0 X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/success//%22http:/www.example.com/cgi/success/?a=commitdiff_plain;h=2dbee8cc17b59991364fc541a7d7eb8d4a77cb21;p=dovecot.git Merge version 1:2.4.3+dfsg1-2+rpi1 and 1:2.4.5+dfsg1-2 to produce 1:2.4.5+dfsg1-2+rpi1 --- 2dbee8cc17b59991364fc541a7d7eb8d4a77cb21 diff --cc debian/changelog index a57cdfa,5bc5278..8691284 --- a/debian/changelog +++ b/debian/changelog @@@ -1,9 -1,112 +1,119 @@@ - dovecot (1:2.4.3+dfsg1-2+rpi1) forky-staging; urgency=medium ++dovecot (1:2.4.5+dfsg1-2+rpi1) forky-staging; urgency=medium + + [changes brought forward from 1:2.3.21+dfsg1-3+rpi1 by Peter Michael Green at Thu, 20 Jun 2024 17:16:27 +0000] + * Disablte testsuite. + - -- Raspbian forward porter Sat, 18 Apr 2026 18:33:51 +0000 ++ -- Raspbian forward porter Thu, 10 Sep 2026 00:19:16 +0000 ++ + dovecot (1:2.4.5+dfsg1-2) unstable; urgency=medium + + * [8b432dd] lib: xxh64: fix byte ordering issue on big-endian systems + (Closes: #1146449) + * [45b5e14] Fix loong64 ftbfs (Closes: #1146490) + + -- Noah Meyerhans Wed, 02 Sep 2026 12:17:57 -0400 + + dovecot (1:2.4.5+dfsg1-1) unstable; urgency=medium + + * [e470328] New upstream version 2.4.5+dfsg1 (Closes: #1146018) + - https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html + - CVE-2026-27852 - DoS by sending mail with bad header. + - CVE-2026-33263 - submission-login: Panic when + mail_max_userip_connections is reached + - CVE-2026-33604 - SMTP Smuggling via Missing Dot-Stuffing After Bare + Carriage Return. + - CVE-2026-33605 - managesieve-login: Pre-auth crash. + - CVE-2026-33606 - dsync: Mail content can cause dsync protocol + injection. + - CVE-2026-33607 - Dovecot IMAP LIST match_sub() Exponential + Backtracking - CPU Denial of Service. + - CVE-2026-40013 - pigeonhole: Stack Buffer Underflow in Pigeonhole + ManageSieve CHECKSCRIPT/PUTSCRIPT. + - CVE-2026-40014 - Whenever a mail client issues a THREAD command on + the affected mailbox, this can cause degradation or denial of + service for IMAP. + - CVE-2026-40015 - An attacker that has valid credentials can open + many connections to the imap-hibernate service and send invalid + commands, which can intermittently cause an out-of-bounds read and + crash the process. + - CVE-2026-40017 - IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision + in strmap + - CVE-2026-40018 - MySQL multi-byte escaping wrong. + - CVE-2026-40019 - v2.4.3 regression: managesieve-login pre-auth + infinite loop. + - CVE-2026-40203 - IMAP Compression Can Reveal Whether a Small Synced + Email Body Matches Sender-Chosen Text. + - CVE-2026-40204 - acl: lda_mailbox_autocreate can bypass acl + restrictions. + - CVE-2026-40205 - OAuth2 passdb scope enforcement bypass via OR + semantics in remote validation path + - CVE-2026-42007 - Sieve editheader RCE. An attacker that has valid + credentials can use a Sieve script with the editheader extension to + trigger a use-after-free in the mail editing code, and to write + memory contents beyond the intended buffer into the delivered mail. + - CVE-2026-42008 - XCLIENT FORWARD= bare token not namespaced, allows + nopassword injection via trusted proxy. + - CVE-2026-42391 - imap: Pre-login memory/CPU growth with ID command. + - CVE-2026-42392 - imap-urlauth leaks memory into user-visible error + messages. + - CVE-2026-42393 - doveadm_password or api key length can still be + leaked with timing comparisons. + - CVE-2026-42395 - Single NUL-Byte XCLIENT FORWARD Payload Crashes. A + host listed as a trusted proxy can send forwarding information + containing a NUL byte, which crashes the login process on the + following login attempt. + - CVE-2026-52681 - Sieve resource usage tracking lost when active + script changes. + - CVE-2026-52687 - IMAP: COMPRESS ZSTD can cause excessive memory + usage. + - CVE-2026-73208 - auth: db-oauth2: aud claim used as fallback for + missing scope claim. + - CVE-2026-73209 - imap-login crash: Self-recursion on zero-output + decompress chunks. + * [0f045ed] refresh patches + * [43cc0a0] d/copyright: reflect upstream's removal of src/lib-otp + * [e781a92] update dovecot-mysql transitional package metadata + + -- Noah Meyerhans Mon, 31 Aug 2026 15:19:46 -0400 + + dovecot (1:2.4.4+dfsg1-2) unstable; urgency=medium + + [ Noah Meyerhans ] + * [d8ee54a] Add rpmsvc-proto to build-depends (Closes: #1130117) + * [a5aa505] replace dovecot-mysql with dovecot-mariadb (Closes: #1137297) + * [fc77cc8] add an autopkgtest for gssapi + * [b41535d] remove /etc/dovecot/private dpkg-statoverride on purge + (Closes: #1139630) + + [ Florian Best ] + * [6c605dd] docs(conf): fix references to new placeholder format + * [0896294] docs(conf): remove trailing whitespace + * [03417d4] docs(conf): fix documentation about boolean plugin configuration + + -- Noah Meyerhans Thu, 30 Jul 2026 15:13:37 -0400 + + dovecot (1:2.4.4+dfsg1-1) unstable; urgency=medium + + [ Luca Boccassi ] + * [6261bfd] Install and use sysusers.d config file + + [ Noah Meyerhans ] + * [9a7a738] Add tests for bug 1134464 regression + * [6f1a08b] remove unreproducible TEST_DIR in dovecot-config + * [185a225] New upstream version 2.4.4+dfsg1 + - CVE-2026-27851: lib-var-expand: Safe filter leaks to all following pipelines + - CVE-2026-40016: Sieve :contains/:matches O(N×M) Substring Match Bypasses + sieve_max_cpu_time Limit (130× Overrun) + - CVE-2026-33603: login: Base64 input can contain tabs that bypass IPC + protection + - CVE-2026-40020: IMAP folders can be shared-spammed to everyone + - CVE-2026-42006: imap-login: Excessive memory usage DoS + (Closes: #1136444) + * [a6c0328] settings: Use correct symbol STORAGE_LDAP in settings-get.pl + * [874cea7] refresh patches + * [a4af2a3] Fix test failures on 32-bit systems + + -- Noah Meyerhans Thu, 14 May 2026 13:29:38 -0400 dovecot (1:2.4.3+dfsg1-2) unstable; urgency=medium