From: Timo Sirainen Date: Tue, 4 Nov 2025 09:34:30 +0000 (+0200) Subject: [PATCH 01/24] auth: Don't disconnect auth client when invalid base64 SASL input is... X-Git-Tag: archive/raspbian/1%2.4.1+dfsg1-6+rpi1+deb13u4^2~25 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=9ef5c047b5834d13e225d6d1a6a1c917b747a89f;p=dovecot.git [PATCH 01/24] auth: Don't disconnect auth client when invalid base64 SASL input is received The base64 input comes from untrusted client. It shouldn't cause the auth client to disconnect, which causes other concurrent logins to be aborted. Broken by 1486c30e191ff079bfa78e7950173bb33d8073d9 Gbp-Pq: Name CVE-2025-59028.patch --- diff --git a/src/auth/auth-request-handler.c b/src/auth/auth-request-handler.c index 35acb24..c0169c8 100644 --- a/src/auth/auth-request-handler.c +++ b/src/auth/auth-request-handler.c @@ -715,6 +715,9 @@ int auth_request_handler_auth_begin(struct auth_request_handler *handler, auth_request_handler_auth_fail_code(handler, request, AUTH_CLIENT_FAIL_CODE_INVALID_BASE64, "Invalid base64 data in initial response"); + /* The base64 input came from untrusted client. It's + an expected auth failure, so don't disconnect the + auth client. */ return 1; } initial_resp_data = @@ -787,7 +790,10 @@ int auth_request_handler_auth_continue(struct auth_request_handler *handler, auth_request_handler_auth_fail_code(handler, request, AUTH_CLIENT_FAIL_CODE_INVALID_BASE64, "Invalid base64 data in continued response"); - return -1; + /* The base64 input came from untrusted client. It's + an expected auth failure, so don't disconnect the + auth client. */ + return 1; } }