From: Timo Sirainen <timo.sirainen@open-xchange.com>
Date: Mon, 27 Apr 2026 22:51:01 +0000 (+0300)
Subject: [PATCH 2/2] doveadm: Avoid leaking doveadm_password or doveadm_api_key lengths
X-Git-Tag: archive/raspbian/1%2.4.1+dfsg1-6+rpi1+deb13u7^2~3
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=b5535c1d0bfbec6b48e40387ff94532eb10106b0;p=dovecot.git

[PATCH 2/2] doveadm: Avoid leaking doveadm_password or doveadm_api_key lengths


Gbp-Pq: Name 0002-doveadm-Avoid-leaking-doveadm_password-or-doveadm_ap.patch
---

diff --git a/src/doveadm/client-connection-http.c b/src/doveadm/client-connection-http.c
index dfbc352..f083ac6 100644
--- a/src/doveadm/client-connection-http.c
+++ b/src/doveadm/client-connection-http.c
@@ -973,7 +973,7 @@ doveadm_http_server_auth_basic(struct client_request_http *req,
 	b64_value = t_base64_encode_str(0, UINT_MAX, value);
 
 	if (creds->data != NULL &&
-	    str_equals_timing_almost_safe(str_c(b64_value), creds->data))
+	    str_equals_hash_timing_safe(str_c(b64_value), creds->data))
 		return TRUE;
 
 	e_error(conn->conn.event,
@@ -999,7 +999,7 @@ doveadm_http_server_auth_api_key(struct client_request_http *req,
 
 	b64_value = t_base64_encode_str(0, UINT_MAX, set->doveadm_api_key);
 	if (creds->data != NULL &&
-	    str_equals_timing_almost_safe(creds->data, str_c(b64_value)))
+	    str_equals_hash_timing_safe(creds->data, str_c(b64_value)))
 		return TRUE;
 
 	e_error(conn->conn.event,
diff --git a/src/doveadm/client-connection-tcp.c b/src/doveadm/client-connection-tcp.c
index cb16f72..b374028 100644
--- a/src/doveadm/client-connection-tcp.c
+++ b/src/doveadm/client-connection-tcp.c
@@ -400,7 +400,7 @@ client_connection_tcp_authenticate(struct client_connection_tcp *conn)
 		return -1;
 	}
 	pass = t_strndup(data + 9, size - 9);
-	if (!str_equals_timing_almost_safe(pass, set->doveadm_password)) {
+	if (!str_equals_hash_timing_safe(pass, set->doveadm_password)) {
 		e_error(conn->conn.event,
 			"doveadm client authenticated with wrong password");
 		return -1;