File _patchinfo of Package patchinfo.20312

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.20312

<patchinfo incident="20312">
  <issue tracker="cve" id="2020-28200"/>
  <issue tracker="cve" id="2021-29157"/>
  <issue tracker="bnc" id="1187420">VUL-0: CVE-2020-28200: dovecot,dovecot22,dovecot23: Attacker can DoS the mail delivery system</issue>
  <issue tracker="bnc" id="1187418">VUL-0: CVE-2021-29157: dovecot,dovecot22,dovecot23: Local attacker can login as any user and access their emails</issue>
  <issue tracker="bnc" id="1187419">VUL-0: CVE-2021-33515: dovecot,dovecot22,dovecot23: Attacker can potentially steal user credentials and mails</issue>
  <issue tracker="jsc" id="SLE-19970"/>
  <packager>varkoly</packager>
  <rating>moderate</rating>
  <category>security</category>
  <summary>Security update for dovecot23</summary>
  <description>This update for dovecot23 fixes the following issues:

Update dovecot to version 2.3.15 (jsc#SLE-19970):

Security issues fixed:

- CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
  JWT tokens. This may be used to supply attacker controlled keys to
  validate tokens, if attacker has local access. (bsc#1187418)
  Local attacker can login as any user and access their emails
- CVE-2021-33515:  On-path attacker could have injected plaintext commands
  before STARTTLS negotiation that would be executed after STARTTLS
  finished with the client. (bsc#1187419)
  Attacker can potentially steal user credentials and mails

* Disconnection log messages are now more standardized across services.
  They also always now start with "Disconnected" prefix.
* Dovecot now depends on libsystemd for systemd integration.
* Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
* config: Some settings are now marked as "hidden". It's discouraged to
  change these settings. They will no longer be visible in doveconf
  output, except if they have been changed or if doveconf -s parameter
  is used. See https://doc.dovecot.org/settings/advanced/ for details.
* imap-compress: Compression level is now algorithm specific.
  See https://doc.dovecot.org/settings/plugin/compress-plugin/
* indexer-worker: Convert "Indexed" info logs to an event named
  "indexer_worker_indexing_finished". See
  https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
+ Add TSLv1.3 support to min_protocols.
+ Allow configuring ssl_cipher_suites. (for TLSv1.3+)
+ acl: Add acl_ignore_namespace setting which allows to entirely ignore
  ACLs for the listed namespaces.
+ imap: Support official RFC8970 preview/snippet syntax. Old methods of
  retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
  with explicit algorithm selection") have been deprecated.
+ imapc: Support INDEXPVT for imapc storage to enable private
  message flags for cluster wide shared mailboxes.
+ lib-storage: Add new events: mail_opened, mail_expunge_requested,
  mail_expunged, mail_cache_lookup_finished. See
  https://doc.dovecot.org/admin_manual/list_of_events/#mail
+ zlib, imap-compression, fs-compress: Support compression levels that
  the algorithm supports. Before, we would allow hardcoded value between
  1 to 9 and would default to 6. Now we allow using per-algorithm value
  range and default to whatever default the algorithm specifies.
- *-login: Commands pipelined together with and just after the authenticate
  command cause these commands to be executed twice. This applies to all
  protocols that involve user login, which currently comprises of imap,
  pop3, submisision and managesieve.
- *-login: Processes are supposed to disconnect the oldest non-logged in
  connection when process_limit was reached. This didn't actually happen
  with the default "high-security mode" (with service_count=1) where each
  connection is handled by a separate process.
- *-login: When login process reaches client/process limits, oldest
  client connections are disconnected. If one of these was still doing
  anvil lookup, this caused a crash. This could happen only if the login
  process limits were very low or if the server was overloaded.
- Fixed building with link time optimizations (-flto).
- auth: Userdb iteration with passwd driver does not always return all
  users with some nss drivers.
- dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
  disabled. If a user has a shared mailbox which is another user's INBOX,
  dsync didn't include the mailbox in syncing unless explicit naming is
  enabled with "mail_shared_explicit_inbox" set to "yes".
- dsync: Shared namespaces were not synced with "-n" flag.
- dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
  If a user has a shared mailbox that is another user's INBOX, dsync
  failed to export the mailbox if mail attributes are disabled.
- fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
  requests to assert-crash: Panic: file http-client-request.c: line 1232
  (http_client_request_send_more): assertion failed: (req->payload_input != NULL)
- fts-tika: 5xx errors returned by Tika server as indexing failures.
  However, Tika can return 5xx for some attachments every time.
  So the 5xx error should be retried once, but treated as success if it
  happens on the retry as well. v2.3 regression.
- fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
  resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
  assertion failed: (ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input))
- imap: SETMETADATA could not be used to unset metadata values.
  Instead NIL was handled as a "NIL" string. v2.3.14 regression.
- imap: IMAP BINARY FETCH crashes at least on empty base64 body:
  Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
  assertion failed: (block_count == 0 || block_idx+1 == block_count)
- imap: If IMAP client using the NOTIFY command was disconnected while
  sending FETCH notifications to the client, imap could crash with
  Panic: Trying to close mailbox INBOX with open transactions.
- imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
  when IMAP commands are >8 kB long.
- imapc: If remote server sent BYE but didn't immediately disconnect, it
  could cause infinite busy-loop.
- lib-index: Corrupted cache record size in dovecot.index.cache file
  could have caused a crash (segfault) when accessing it.
- lib-oauth2: JWT token time validation now works correctly with
  32-bit systems.
- lib-ssl-iostream: Checking hostnames against an SSL certificate was
  case-sensitive.
- lib-storage: Corrupted mime.parts in dovecot.index.cache may have
  resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
  assertion failed: (text == ((part->flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
- lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
  preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
  session could have accessed all of the emails' metadata to read their
  POP3 UIDL (opening dbox files).
- listescape: When using the listescape plugin and a shared namespace
  the plugin didn't work properly anymore resulting in errors like:
  "Invalid mailbox name: Name must not have '/' character."
- lmtp: Connection crashes if connection gets disconnected due to
  multiple bad commands and the last bad command is BDAT.
- lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
  forwarded by LMTP proxy without checking that the backend has support.
  This caused a command parameter error from the backend if it was
  running an older Dovecot release. This could only occur in more complex
  setups where the message was proxied twice; when the proxy generated
  the XRCPTFORWARD parameter itself the problem did not occur, so this
  only happened when it was forwarded.
- lmtp: The LMTP proxy crashes with a panic when the remote server
  replies with an error while the mail is still being forwarded through
  a DATA/BDAT command.
- lmtp: Username may have been missing from lmtp log line prefixes when
  it was performing autoexpunging.
- master: Dovecot would incorrectly fail with haproxy 2.0.14 service
  checks.
- master: Systemd service: Dovecot announces readiness for accepting
  connections earlier than it should. The following environment variables
  are now imported automatically and can be omitted from
  import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
- master: service { process_min_avail } was launching processes too
  slowly when master was forking a lot of processes.
- util: Make the health-check.sh example script POSIX shell compatible.
* Added new aliases for some variables. Usage of the old ones is possible,
  but discouraged. (These were partially added already to v2.3.13.)
  See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
  for more information.
* Optimize imap/pop3/submission/managesieve proxies to use less CPU at
  the cost of extra memory usage.
* Remove autocreate, expire, snarf and mail-filter plugins.
* Remove cydir storage driver.
* Remove XZ/LZMA write support. Read support will be removed in future release.
* doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
  environment variable is not set. Timestamp format is taken from
  log_timestamp setting.
* If BROKENCHAR or listescape plugin is used, the escaped folder names
  may be slightly different from before in some situations. This is
  unlikely to cause issues, although caching clients may redownload the
  folders.
* imapc: It now enables BROKENCHAR=~ by default to escape remote folder
  names if necessary. This also means that if there are any '~'
  characters in the remote folder names, they will be visible as "~7e".
* imapc: When using local index files folder names were escaped on
  filesystem a bit differently. This affects only if there are folder
  names that actually require escaping, which isn't so common. The old
  style folders will be automatically deleted from filesystem.
* stats: Update exported metrics to be compliant with OpenMetrics standard.
+ doveadm: Add an optional '-p' parameter to metadata list command. If
  enabled, "/private", and "/shared" metadata prefixes will be prepended
  to the keys in the list output.
+ doveconf: Support environment variables in config files. See
  https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
  for more details.
+ indexer-worker: Change indexer to disconnect from indexer-worker
  after each request. This allows service indexer-worker's service_count &amp;
  idle_kill settings to work. These can be used to restart indexer-worker
  processes once in a while to reduce their memory usage.
- auth: "nodelay" with various authentication mechanisms such as apop
  and digest-md5 crashed AUTH process if authentication failed.
- auth: Auth lua script generating an error triggered an assertion
  failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
  assertion failed: (lua_gettop(script->L) == 0).
- configure: Fix libunwind detection to work on other than x86_64 systems.
- doveadm-server: Process could crash if logging was done outside command
  handling. For example http-client could have done debug logging
  afterwards, resulting in either segfault or Panic:
  file http-client.c: line 642 (http_client_context_close):
  assertion failed: (cctx->clients_list == NULL).
- dsync: Folder name escaping with BROKENCHAR didn't work completely
  correctly. This especially caused problems with dsync-migrations using
  imapc where some of the remote folder names may not have been accessible.
- dsync: doveadm sync + imapc doesn't always sync all mails when doing
  an incremental sync (-1), which could lead to mail loss when it's used
  for migration. This happens only when GUIDs aren't used (i.e.
  imapc without imapc_features=guid-forced).
- fts-tika: When tika server returns error, some mails cause Panic:
  file message-parser.c: line 802 (message_parser_deinit_from_parts):
  assertion failed: (ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input))
- lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
  resulted in crashes. This exposed that Dovecot was wrongly accepting
  atoms in "nstring" handling. Changed the IMAP parsing to be more
  strict about this now.
- lib-index: If dovecot.index.cache has corrupted message size, fetching
  BODY/BODYSTRUCTURE may cause assert-crash:
  Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
  assertion failed: (mail->data.parts != NULL).
- lib-index: Minor error handling and race condition fixes related to
  rotating dovecot.index.log. These didn't usually cause problems,
  unless the log files were rotated rapidly.
- lib-lua: Lua scripts using coroutines or lua libraries using coroutines
  (e.g., cqueues) panicked.
- Message PREVIEW handled whitespace wrong so first space would get
  eaten from between words.
- FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
- lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
  was written in a way that may have caused confusion for IMAP clients
  and also Dovecot itself when parsing it. The truncated part is now
  written out using application/octet-stream MIME type.
- lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
  use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
  (meth->context_size &lt;= MAC_MAX_CONTEXT_SIZE).
- event filters: NOT keyword did not have the correct associativity.
- Ignore ECONNRESET when closing socket. This avoids logging useless
  errors on systems like FreeBSD.
- event filters: event filter syntax error may lead to Panic:
  file event-filter.c: line 137 (event_filter_parse): assertion failed:
  (state.output == NULL)
- lib: timeval_cmp_margin() was broken on 32-bit systems. This could
  potentially have caused HTTP timeouts to be handled incorrectly.
- log: instance_name wasn't used as syslog ident by the log process.
- master: After a service reached process_limit and client_limit, it
  could have taken up to 1 second to realize that more client connections
  became available. During this time client connections could have been
  unnecessarily rejected and a warning logged:
  Warning: service(...): process_limit (...) reached, client connections are being dropped
- stats: Crash would occur when generating openmetrics data for metrics
  using aggregating functions.
- stats: Event filters comparing against empty strings crash the stats
  process.
* CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
  allow logged in user to access other people's emails and filesystem
  information.
* Metric filter and global event filter variable syntax changed to a
  SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
* auth: Added new aliases for %{variables}. Usage of the old ones is
  possible, but discouraged.
* auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
  mechanism and related password schemes.
* auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
* auth: Removed postfix postmap socket
+ auth: Added new fields for auth server events. These fields are now
  also available for all auth events. See
  https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
  for details.
+ imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
  and imap_client_unhibernate_retried events. See
  https://doc.dovecot.org/admin_manual/list_of_events/ for details.
+ lib-index: Added new mail_index_recreated event. See
  https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
+ lib-sql: Support TLS options for cassandra driver. This requires
  cpp-driver v2.15 (or later) to work reliably.
+ lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
  added to existing mails if mail_attachment_detection_option=add-flags
  and it can be done inexpensively.
+ login proxy: Added login_proxy_max_reconnects setting (default 3) to
  control how many reconnections are attempted.
+ login proxy: imap/pop3/submission/managesieve proxying now supports
  reconnection retrying on more than just connect() failure. Any error
  except a non-temporary authentication failure will result in reconnect
  attempts.
- auth: Lua passdb/userdb leaks stack elements per call, eventually
  causing the stack to become too deep and crashing the auth or
  auth-worker process.
- auth: SASL authentication PLAIN mechanism could be used to trigger
  read buffer overflow. However, this doesn't seem to be exploitable in
  any way.
- auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
  disallows NUL bytes for it.
- dict: Process used too much CPU when iterating keys, because each key
  used a separate write() syscall.
- doveadm-server: Crash could occur if logging was done outside command
  handling. For example http-client could have done debug logging
  afterwards, resulting in either segfault or
  Panic: file http-client.c: line 642 (http_client_context_close):
  assertion failed: (cctx->clients_list == NULL).
- doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
  process via starttls assert-crashed if there were no ssl=yes listeners:
  Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
  assertion failed: (service->ssl_ctx_initialized).
- fts-solr: HTTP requests may have assert-crashed:
  Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
  assertion failed: (req->payload_input != NULL)
- imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
  configuration that causes errors. Sending the error responses to the
  client can cause the segmentation fault. This can for example happen
  when several namespaces use the same mail storage location.
- imap: IMAP NOTIFY used on a shared namespace that doesn't actually
  exist (e.g. public namespace for a nonexistent user) can crash with a panic:
  Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
- imap: IMAP session can crash with QRESYNC extension if many changes
  are done before asking for expunged mails since last sync.
- imap: Process might hang indefinitely if client disconnects after
  sending some long-running commands pipelined, for example FETCH+LOGOUT.
- lib-compress: Mitigate crashes when configuring a not compiled in
  compression. Errors with compression configuration now distinguish
  between not supported and unknown.
- lib-compression: Using xz/lzma compression in v2.3.11 could have
  written truncated output in some situations. This would result in
  "Broken pipe" read errors when trying to read it back.
- lib-compression: zstd compression could have crashed in some situations:
  Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream->blocking)
- lib-dict: dict client could have crashed in some rare situations when
  iterating keys.
- lib-http: Fix several assert-crashes in HTTP client.
- lib-index: v2.3.11 regression: When mails were expunged at the same
  time as lots of new content was being saved to the cache (e.g. cache
  file was lost and is being re-filled) a deadlock could occur with
  dovecot.index.cache / dovecot.index.log.
- lib-index: v2.3.11 regression: dovecot.index.cache file was being
  purged (rewritten) too often when it had a field that hadn't been
  accessed for over 1 month, but less than 2 months. Every cache file
  change caused a purging in this situation.
- lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
  Regression caused by fixing CVE-2020-12100.
- lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
  was written in a way that may have caused confusion for both IMAP
  clients and Dovecot itself when parsing it. The truncated part is now
  written out using application/octet-stream MIME type.
- lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
  10000th MIME part was message/rfc822 (or if parent was multipart/digest):
  Panic: file message-parser.c: line 167 (message_part_append):
  assertion failed: (ctx->total_parts_count &lt;= ctx->max_total_mime_parts).
- lib-oauth2: Dovecot incorrectly required oauth2 server introspection
  reply to contain username with invalid token.
- lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
  deprecated APIs disabled.
- lib-storage: When mail's size is different from the cached one (in
  dovecot.index.cache or Maildir S=size in the filename), this is
  handled by logging "Cached message size smaller/larger than expected"
  error. However, in some situations this also ended up crashing with:
  Panic: file istream.c: line 315 (i_stream_read_memarea):
  assertion failed: (old_size &lt;= _stream->pos - _stream->skip).
- lib-storage: v2.3 regression: Copying/moving mails was taking much more
  memory than before. This was mainly visible when copying/moving
  thousands of mails in a single transaction.
- lib-storage: v2.3.11 regression: Searching messages assert-crashed
  (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
  assertion failed: (ctx->nested_parts_count > 0).
- lib: Dovecot v2.3 moved signal handlers around in ioloops,
  causing more CPU usage than in v2.2.
- lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
  in error if it happened to be at read boundary. Any NUL characters and
  '\u0000' will now result in parsing error instead of silently
  truncating the data.
- lmtp, submission: Server may hang if SSL client connection disconnects
  during the delivery. If this happened repeated, it could have ended
  up reaching process_limit and preventing any further lmtp/submission
  deliveries.
- lmtp: Proxy does not always properly log TLS connection problems as
  errors; in some cases, only a debug message is logged if enabled.
- lmtp: The LMTP service can hang when commands are pipelined. This can
  particularly occur when one command in the middle of the pipeline fails.
  One example of this occurs for proxied LMTP transactions in which the
  final DATA or BDAT command is pipelined after a failing RCPT command.
- login-proxy: The login_source_ips setting has no effect, and therefore
  the proxy source IPs are not cycled through as they should be.
- master: Process was using 100% CPU in some situations when a broken
  service was being throttled.
- pop3-login: POP3 login would fail with "Input buffer full" if the
  initial response for SASL was too long.
- stats: Crash would occur when generating openmetrics data for metrics
  using aggregating functions.

Update pigeonhole to version 0.5.15

* CVE-2020-28200: Sieve interpreter is not protected against abusive
  scripts that claim excessive resource usage. Fixed by limiting the
  user CPU time per single script execution and cumulatively over
  several script runs within a configurable timeout period. Sufficiently
  large CPU time usage is summed in the Sieve script binary and execution
  is blocked when the sum exceeds the limit within that time. The block
  is lifted when the script is updated after the resource usage times out.
  (bsc#1187420) Attacker can DoS the mail delivery system
  (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
* Disconnection log messages are now more standardized across services.
  They also always now start with "Disconnected" prefix.
* managesieve: Commands pipelined together with and just after the
  authenticate command cause these commands to be executed twice.
* duplicate: The test was handled badly in a multiscript (sieve_before,
  sieve_after) scenario in which an earlier script in the sequence with
  a duplicate test succeeded, while a later script caused a runtime
  failure. In that case, the message is recorded for duplicate tracking,
  while the message may not actually have been delivered in the end.
* editheader: Sieve interpreter entered infinite loop at startup when
  the "editheader" configuration listed an invalid header name. This
  problem can only be triggered by the administrator.
* relational: The Sieve relational extension can cause a segfault at
  compile time. This is triggered by invalid script syntax. The segfault
  happens when this match type is the last argument of the test command.
  This situation is not possible in a valid script; positional arguments
  are normally present after that, which would prevent the segfault.
* sieve: For some Sieve commands the provided mailbox name is not
  properly checked for UTF-8 validity, which can cause assert crashes at
  runtime when an invalid mailbox name is encountered. This can be
  caused by the user by writing a bad Sieve script involving the
  affected commands ("mailboxexists", "specialuse_exists").
  This can be triggered by the remote sender only when the user has
  written a Sieve script that passes message content to one of the
  affected commands.
* sieve: Large sequences of 8-bit octets passed to certain Sieve
  commands that create or modify message headers that allow UTF-8 text
  (vacation, notify and addheader) can cause the delivery or IMAP
  process (when IMAPSieve is used) to enter a memory-consuming
  semi-infinite loop that ends when the process exceeds its memory
  limits. Logged in users can cause these hangs only for their own
  processes.

</description>
</patchinfo>

Places

File _patchinfo of Package patchinfo.20312

Places