https://github.com/resiprocate/resiprocate/releases/tag/resiprocate-1.14.0
Fixes the following security problems:
Use CSPRNG for security-sensitive SIP/STUN/TURN tokens (CWE-338)
Use crypto RNG when generating certificates and nonce
Use crypto RNG to generate various IDs that are supposed to be unique
Improve transaction ID uniqueness
Authenticate STUN Binding responses (CWE-345)
Add Digest Authentication Support for SHA256 and SHA512/256 algorithms
Add new DigestStream class, capable of MD5, SHA1, SHA256, SHA512 and SHA512/256 hash algorithms
TLS handshake fixes
Avoid using undefined client verification mode in TLS connection
Disable TLS compression by default
Correct TLS logging
Allow applications to get TLS connection/handshake errors
Propagate SSL Certificate Validation errors to ConnectionTerminated event/message
Cleanup SecurityAttributes
WinSecurity: expand constructors to allow setting of defaultPrivateKeyPassPhrase and DHParamsFilename
WinSecurity: perform normal preload process so that domain certificates can be loaded
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fixes build error with host-gcc-final:
options.cc:27216:2: error: #error 0Wabsolute-value does not have a Var() flag
27216 | #error 0Wabsolute-value does not have a Var() flag
$ head -n1 output/build/host-gcc-final-16.2.0/build/gcc/options.cc
/* This file is auto-generated by optc-gen.awk. */
introduced by the bump of gawk to 5.4.1 with buildroot commit
aa3db5b4e1.
Fixes:
https://autobuild.buildroot.net/results/672/6727e71716af3df8e2175a50740388bc669e5462/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2.4.0:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/UYNR6GBP25XEGFCS633SWPR4HXV3NSS3/
"Pigeonhole versioning has been changed to match Dovecot versioning."
"New 2.4 packages are not compatible with old 2.3 configuration, please
carefully review https://doc.dovecot.org/2.4.0/installation/upgrade/2.3-to-2.4.html
before installing the new packages."
2.4.1:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/XPT6TA7Y4B4QZZQ2XUE46Z35BDR2X2AA/
2.4.2:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/XTMMPVQ3QKQMYDZ3CZZCXPNHN7OXKS3L/
Fixes CVE-2025-30189:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/G3K5HMBKW6XOYNBXYV5GUM2GR6WPUD4M/
2.4.3:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/IKIHZX77IPTGSP5WBIPJUOFBUQFKVPE7/
Fixes various CVEs:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/I4KFFV4IKP6M5MS67SWYHKDSDMSNILQG/
* CVE-2025-59028: Invalid base64 authentication can cause DoS for other
logins.
* CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks
and read unintended files during indexing. Fixed by dropping the script.
* CVE-2026-24031: SQL injection possible if auth_username_chars is
configured empty. Fixed escaping to always happen. v2.4 regression.
* CVE-2026-27859: Excessive RFC 2231 MIME parameters in email would cause
excessive CPU usage. Fixed by limiting number of parameters to process.
* CVE-2026-27860: LDAP query injection possible if auth_username_chars
is configured empty. Fixed escaping to always happen. v2.4 regression.
* CVE-2026-27857: Sending excessive parenthesis causes imap-login to use
excessive memory.
* CVE-2026-27856: Doveadm credentials were not checked using timing-safe
checking function.
* CVE-2026-27855: OTP driver vulnerable to replay attack.
* CVE-2026-27858: managesieve-login can allocate large amount of memory
during authentication.
* CVE-2025-59032: ManageSieve panic occurs with sieve-connect as a client.
2.4.4:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/YW7GVOH3VVLNAYW2C4TEBTGJW52J7F6H/
Fixes various CVEs:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/YQYBB3NJPNFFJ4SHDU7PLXLRRGHBJKSK/
* CVE-2026-27851: lib-var-expand: Safe filter marks all following pipelines safe.
* CVE-2026-33603: auth: CRAM-SHA-*-PLUS channel binding could be faked.
MITM attacker with a certificate trusted by the client could have
bypassed the requirement for channel binding.
* CVE-2026-40020: IMAP folders can be shared-spammed to everyone.
* CVE-2026-42006: An attacker can cause uncontrolled memory usage with
excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete.
* CVE-2026-40016: sieve :contains and :matches operators could have been
using excessive amount of CPU. Limit the CPU to sieve_max_cpu_time.
2.4.5:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/D7FJQODYCY23BG3FWUZXCJRCLCPT7RZT/
Fixes various CVEs:
https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/WT4USR35HN43TGQGVDXPDAMCUTGLVMET/
* CVE-2026-27852: Messages with a huge number of From/To/Cc/etc email addresses
could result in excessive memory usage.
* CVE-2026-33263: Submission: Login service crashes with panic once
mail_max_userip_connections limit is reached.
* CVE-2026-33604: The SMTP outbound dot-stuffing mechanism does not properly
escape dots following a bare \r in message bodies, potentially allowing
spoofed emails via malicious end-of-DATA injection.
* CVE-2026-33606: Mail content stored by a user can be crafted so that it is
interpreted as dsync protocol commands when an administrator later runs dsync
with the stream protocol, for example during a migration.
* CVE-2026-33607: IMAP LIST command could be used to cause excessive CPU usage.
* CVE-2026-40014: IMAP THREAD command could have used excessive amount of CPU
processing a single email with a massive number of Message-IDs in References
header.
* CVE-2026-40015: Invalid IMAP command sent to imap-hibernate process might
crash it.
* CVE-2026-40017: IMAP THREAD command could have used excessive amount of CPU
processing emails with a large number of specially crafted Message-IDs in
References header. The fix requires a new dovecot.index.thread file format,
which is enabled only after setting dovecot_storage_version or newer. This
rebuilds the index, so it will cause some extra CPU usage and extra
metacache disk IO usage. It shouldn't cause (much) extra object storage IO,
because all the fields should be coming from dovecot.index.cache.
* CVE-2026-40203: When IMAP COMPRESS=DEFLATE was enabled, an attacker
could send mails into a victim's mailbox and observe network traffic to
determine whether a secret message matched a known string by comparing
compressed response sizes (a CRIME-style attack). The fix resets the
compression dictionary after each IMAP command, preventing information from
leaking between commands.
* CVE-2026-40205: If multiple OAUTH scopes were required, then
this could have been only partially enforced with certain
configurations.
* CVE-2026-4200: XCLIENT FORWARD allows to forward key only passdb
fields without the "forward_" prefix which allows connections from
trusted networks to set nopasswd field which allows to skip the
authentication.
* CVE-2026-42391: Pre-login IMAP ID command could have used excessive
amount of memory, causing the process to become killed and disconnecting
all the other IMAP connections being proxied by the process. Or
alternatively it could have caused excessive CPU usage, slowing down
all the other IMAP connections being proxied by the process.
* CVE-2026-42392: If URLAUTH is enabled, sending an invalid IMAP URLFETCH
can result in an untagged NO response containing uninitialized memory,
potentially leaking sensitive data.
* CVE-2026-42393: Doveadm password length or API key length could still
be determined via timing based attacks.
* CVE-2026-42395: XCLIENT FORWARD command from login_trusted_networks
could have been used to cause login processes to crash.
* CVE-2026-52681: Sieve resource usage (sieve_max_cpu_time) was tracked
in the active Sieve binary. Switching to a different active binary
could have been used to reset (bypass) the resource usage.
* CVE-2026-52687: Using IMAP COMPRESS ZSTD command can cause excessive
memory usage in imap-login process, possibly making it reach vsz_limit
and kill all the connections being served by the process. Fixed by
disabling COMPRESS command with all other compression algorithms than
the standard DEFLATE.
* CVE-2026-73208: In oauth2, scope/aud checking was done with JWT tokens.
Now it requires all scopes.
* CVE-2026-73209: Sending IMAP COMPRESS package containing zero-length
frames crashes imap or imap-login process.
* CVE-2026-33605: managesieve-login: Pre-auth crash. An unauthenticated attacker
can crash the ManageSieve login process by sending a small malformed command
before authenticating.
* CVE-2026-40019: v2.4.3 regression: managesieve-login pre-auth infinite loop.
An unauthenticated attacker can send a truncated quoted argument to the
ManageSieve login process, which makes it spin in an infinite loop consuming CPU.
* CVE-2026-42007: sieve-editheader: An attacker that has valid credentials can
use a Sieve script with the editheader extension to trigger a use-after-free
in the mail editing code, and to write memory contents beyond the intended
buffer in the delivered mail.
Removed patches which are included in this release.
Added patch 0001 to revert upstream commit which breaks the build:
CCLD test-var-expand-crypt
output/per-package/dovecot/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/9.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld:
attempted static link of dynamic object `./.libs/var_expand_crypt.so'
Select libiconv when needed, upstream removed the optional support in
verion 2.4.2:
8dd2ec82f6
Added optional dependency to pcre2 available since version 2.4.2:
38fc1545fe
which needs BR2_PACKAGE_PCRE2_32:
https://github.com/dovecot/core/blob/2.4.5/m4/want_pcre.m4#L9
Ported path fixup for Makefile from dovecot to dovecot-pigeonhole to fix
build error:
make[6]: *** No rule to make target
'/usr/libexec/dovecot/settings-history.py', needed by
'settings-history-pigeonhole.h'. Stop.
Updated license hashes due to upstream commits:
8de4423b612a5809c1158020ac1380
Added optional support for libkrb5, openldap, postgresql and zstd.
Removed optional support for xz due to its upstream removal:
3e44364d4a
Removed configure option --with-ssl (openssl is already a dependency):
6b0b7141a8
Removed configure options for zlib (zlib is already a dependency):
d666521754
Renamed RPCGEN value in _CONF_ENV to silence configure warning:
./configure: line 34595: __disable_RPCGEN_rquota: command not found
Removed various _CONF_ENV variables due to their upstream removal:
i_cv_inotify_works:
https://github.com/dovecot/core/pull/107#issuecomment-560056967
i_cv_signed_size_t:
52d322449d
i_cv_signed_time_t:
7cedd93c4e
i_cv_c99_vsnprintf:
5dc503907d
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
