Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.2966
Security update for dovecot23
2 September 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: dovecot23
Publisher: SUSE
Operating System: SUSE
Impact/Access: Denial of Service -- Existing Account
Access Confidential Data -- Existing Account
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2021-29157 CVE-2020-28200
Reference: ESB-2021.2199
ESB-2021.2195
Original Bulletin:
https://www.suse.com/support/update/announcement/2021/suse-su-20212890-1
https://www.suse.com/support/update/announcement/2021/suse-su-20212892-1
https://www.suse.com/support/update/announcement/2021/suse-su-20212891-1
Comment: This bulletin contains three (3) SUSE security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for dovecot23
______________________________________________________________________________
Announcement ID: SUSE-SU-2021:2890-1
Rating: moderate
References: #1187418 #1187419 #1187420
Cross-References: CVE-2020-28200 CVE-2021-29157
Affected Products:
SUSE Linux Enterprise Server for SAP 15
SUSE Linux Enterprise Server 15-LTSS
SUSE Linux Enterprise High Performance Computing 15-LTSS
SUSE Linux Enterprise High Performance Computing 15-ESPOS
______________________________________________________________________________
An update that solves two vulnerabilities, contains one feature and has one
errata is now available.
Description:
This update for dovecot23 fixes the following issues:
Update dovecot to version 2.3.15 (jsc#SLE-19970):
Security issues fixed:
o CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT
tokens. This may be used to supply attacker controlled keys to validate
tokens, if attacker has local access. (bsc#1187418) Local attacker can
login as any user and access their emails
o CVE-2021-33515: On-path attacker could have injected plaintext commands
before STARTTLS negotiation that would be executed after STARTTLS finished
with the client. (bsc#1187419) Attacker can potentially steal user
credentials and mails
o Disconnection log messages are now more standardized across services. They
also always now start with "Disconnected" prefix.
o Dovecot now depends on libsystemd for systemd integration.
o Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
o config: Some settings are now marked as "hidden". It's discouraged to
change these settings. They will no longer be visible in doveconf output,
except if they have been changed or if doveconf -s parameter is used. See
https://doc.dovecot.org/settings/advanced/ for details.
o imap-compress: Compression level is now algorithm specific. See https://
doc.dovecot.org/settings/plugin/compress-plugin/
o indexer-worker: Convert "Indexed" info logs to an event named
"indexer_worker_indexing_finished". See
https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexin
g-finished
Add TSLv1.3 support to min_protocols.
Allow configuring ssl_cipher_suites. (for TLSv1.3+)
acl: Add acl_ignore_namespace setting which allows to entirely ignore ACLs for
the listed namespaces.
imap: Support official RFC8970 preview/snippet syntax. Old methods of
retrieving preview information via IMAP commands ("SNIPPET and PREVIEW with
explicit algorithm selection") have been deprecated.
imapc: Support INDEXPVT for imapc storage to enable private message flags for
cluster wide shared mailboxes.
lib-storage: Add new events: mail_opened, mail_expunge_requested,
mail_expunged, mail_cache_lookup_finished. See https://doc.dovecot.org/
admin_manual/list_of_events/#mail
zlib, imap-compression, fs-compress: Support compression levels that the
algorithm supports. Before, we would allow hardcoded value between 1 to 9 and
would default to 6. Now we allow using per-algorithm value range and default to
whatever default the algorithm specifies.
*-login: Commands pipelined together with and just after the authenticate
command cause these commands to be executed twice. This applies to all
protocols that involve user login, which currently comprises of imap, pop3,
submisision and managesieve.
*-login: Processes are supposed to disconnect the oldest non-logged in
connection when process_limit was reached. This didn't actually happen with the
default "high-security mode" (with service_count=1) where each connection is
handled by a separate process.
*-login: When login process reaches client/process limits, oldest client
connections are disconnected. If one of these was still doing anvil lookup,
this caused a crash. This could happen only if the login process limits were
very low or if the server was overloaded.
Fixed building with link time optimizations (-flto).
auth: Userdb iteration with passwd driver does not always return all users with
some nss drivers.
dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was disabled.
If a user has a shared mailbox which is another user's INBOX, dsync didn't
include the mailbox in syncing unless explicit naming is enabled with
"mail_shared_explicit_inbox" set to "yes".
dsync: Shared namespaces were not synced with "-n" flag.
dsync: Syncing shared INBOX failed if mail_attribute_dict was not set. If a
user has a shared mailbox that is another user's INBOX, dsync failed to export
the mailbox if mail attributes are disabled.
fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP requests
to assert-crash: Panic: file http-client-request.c: line 1232
(http_client_request_send_more): assertion failed: (req->payload_input != NULL)
fts-tika: 5xx errors returned by Tika server as indexing failures. However,
Tika can return 5xx for some attachments every time. So the 5xx error should be
retried once, but treated as success if it happens on the retry as well. v2.3
regression.
fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have resulted
in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
assertion failed:
(ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input))
imap: SETMETADATA could not be used to unset metadata values. Instead NIL was
handled as a "NIL" string. v2.3.14 regression.
imap: IMAP BINARY FETCH crashes at least on empty base64 body: Panic: file
index-mail-binary.c: line 358 (blocks_count_lines): assertion failed:
(block_count == 0 || block_idx+1 == block_count)
imap: If IMAP client using the NOTIFY command was disconnected while sending
FETCH notifications to the client, imap could crash with Panic:
Trying to close mailbox INBOX with open transactions.
imap: Using IMAP COMPRESS extension can cause IMAP connection to hang when IMAP
commands are >8 kB long.
imapc: If remote server sent BYE but didn't immediately disconnect, it could
cause infinite busy-loop.
lib-index: Corrupted cache record size in dovecot.index.cache file could have
caused a crash (segfault) when accessing it.
lib-oauth2: JWT token time validation now works correctly with 32-bit systems.
lib-ssl-iostream: Checking hostnames against an SSL certificate was
case-sensitive.
lib-storage: Corrupted mime.parts in dovecot.index.cache may have resulted in
Panic: file imap-bodystructure.c: line 206 (part_write_body): assertion failed:
(text == ((part->flags & MESSAGE_PART_FLAG_TEXT) != 0))
lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't preserve
the "hdr-pop3-uidl" header. Because of this, the next pop3 session could have
accessed all of the emails' metadata to read their POP3 UIDL (opening dbox
files).
listescape: When using the listescape plugin and a shared namespace the plugin
didn't work properly anymore resulting in errors like: "Invalid mailbox name:
Name must not have '/' character."
lmtp: Connection crashes if connection gets disconnected due to multiple bad
commands and the last bad command is BDAT.
lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly forwarded by
LMTP proxy without checking that the backend has support. This caused a command
parameter error from the backend if it was running an older Dovecot release.
This could only occur in more complex setups where the message was proxied
twice; when the proxy generated the XRCPTFORWARD parameter itself the problem
did not occur, so this only happened when it was forwarded.
lmtp: The LMTP proxy crashes with a panic when the remote server replies with
an error while the mail is still being forwarded through a DATA/BDAT command.
lmtp: Username may have been missing from lmtp log line prefixes when it was
performing autoexpunging.
master: Dovecot would incorrectly fail with haproxy 2.0.14 service checks.
master: Systemd service: Dovecot announces readiness for accepting connections
earlier than it should. The following environment variables are now imported
automatically and can be omitted from import_environment setting: NOTIFY_SOCKET
LISTEN_FDS LISTEN_PID.
master: service { process_min_avail } was launching processes too slowly when
master was forking a lot of processes.
util: Make the health-check.sh example script POSIX shell compatible.
Added new aliases for some variables. Usage of the old ones is possible, but
discouraged. (These were partially added already to v2.3.13.) See https://
doc.dovecot.org/configuration_manual/config_file/config_variables/ for more
information.
Optimize imap/pop3/submission/managesieve proxies to use less CPU at the cost
of extra memory usage.
Remove autocreate, expire, snarf and mail-filter plugins.
Remove cydir storage driver.
Remove XZ/LZMA write support. Read support will be removed in future release.
doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
environment variable is not set. Timestamp format is taken from log_timestamp
setting.
If BROKENCHAR or listescape plugin is used, the escaped folder names may be
slightly different from before in some situations. This is unlikely to cause
issues, although caching clients may redownload the folders.
imapc: It now enables BROKENCHAR=~ by default to escape remote folder names if
necessary. This also means that if there are any '~' characters in the remote
folder names, they will be visible as "~7e".
imapc: When using local index files folder names were escaped on filesystem a
bit differently. This affects only if there are folder names that actually
require escaping, which isn't so common. The old style folders will be
automatically deleted from filesystem.
stats: Update exported metrics to be compliant with OpenMetrics standard.
doveadm: Add an optional '-p' parameter to metadata list command. If enabled, "
/private", and "/shared" metadata prefixes will be prepended to the keys in the
list output.
doveconf: Support environment variables in config files. See https://
doc.dovecot.org/configuration_manual/config_file/config_file_syntax /#
environment-variables for more details.
indexer-worker: Change indexer to disconnect from indexer-worker after each
request. This allows service indexer-worker's service_count & idle_kill
settings to work. These can be used to restart indexer-worker processes once in
a while to reduce their memory usage.
auth: "nodelay" with various authentication mechanisms such as apop and
digest-md5 crashed AUTH process if authentication failed.
auth: Auth lua script generating an error triggered an assertion failure:
Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
assertion failed: (lua_gettop(script->L) == 0).
configure: Fix libunwind detection to work on other than x86_64 systems.
doveadm-server: Process could crash if logging was done outside command
handling. For example http-client could have done debug logging afterwards,
resulting in either segfault or Panic: file http-client.c:
line 642 (http_client_context_close): assertion failed:
(cctx->clients_list == NULL).
dsync: Folder name escaping with BROKENCHAR didn't work completely correctly.
This especially caused problems with dsync-migrations using imapc where some of
the remote folder names may not have been accessible.
dsync: doveadm sync + imapc doesn't always sync all mails when doing an
incremental sync (-1), which could lead to mail loss when it's used for
migration. This happens only when GUIDs aren't used (i.e. imapc without
imapc_features=guid-forced).
fts-tika: When tika server returns error, some mails cause Panic: file
message-parser.c: line 802 (message_parser_deinit_from_parts): assertion
failed: (ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input))
lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have resulted in
crashes. This exposed that Dovecot was wrongly accepting atoms in "nstring"
handling. Changed the IMAP parsing to be more strict about this now.
lib-index: If dovecot.index.cache has corrupted message size, fetching BODY/
BODYSTRUCTURE may cause assert-crash: Panic: file index-mail.c:
line 1140 (index_mail_parse_body_finish): assertion failed:
(mail->data.parts != NULL).
lib-index: Minor error handling and race condition fixes related to rotating
dovecot.index.log. These didn't usually cause problems, unless the log files
were rotated rapidly.
lib-lua: Lua scripts using coroutines or lua libraries using coroutines (e.g.,
cqueues) panicked.
Message PREVIEW handled whitespace wrong so first space would get eaten from
between words.
FTS and message PREVIEW (snippet) parsed HTML &entities case-sensitively.
lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE was
written in a way that may have caused confusion for IMAP clients and also
Dovecot itself when parsing it. The truncated part is now written out using
application/octet-stream MIME type.
lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to use
them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
(meth->context_size <= MAC_MAX_CONTEXT_SIZE).
event filters: NOT keyword did not have the correct associativity.
Ignore ECONNRESET when closing socket. This avoids logging useless errors on
systems like FreeBSD.
event filters: event filter syntax error may lead to Panic: file
event-filter.c: line 137 (event_filter_parse): assertion failed:
(state.output == NULL)
lib: timeval_cmp_margin() was broken on 32-bit systems. This could potentially
have caused HTTP timeouts to be handled incorrectly.
log: instance_name wasn't used as syslog ident by the log process.
master: After a service reached process_limit and client_limit, it could have
taken up to 1 second to realize that more client connections became available.
During this time client connections could have been unnecessarily rejected and
a warning logged: Warning: service(...):
process_limit (...) reached, client connections are being dropped
stats: Crash would occur when generating openmetrics data for metrics using
aggregating functions.
stats: Event filters comparing against empty strings crash the stats process.
CVE-2020-24386: Specially crafted command can cause IMAP hibernate to allow
logged in user to access other people's emails and filesystem information.
Metric filter and global event filter variable syntax changed to a SQL-like
format. See https://doc.dovecot.org/configuration_manual/event_filter/
auth: Added new aliases for %{variables}. Usage of the old ones is possible,
but discouraged.
auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth mechanism and
related password schemes.
auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
auth: Removed postfix postmap socket
auth: Added new fields for auth server events. These fields are now also
available for all auth events. See https://doc.dovecot.org/admin_manual/
list_of_events/#authentication-server for details.
imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated and
imap_client_unhibernate_retried events. See https://doc.dovecot.org/
admin_manual/list_of_events/ for details.
lib-index: Added new mail_index_recreated event. See https://doc.dovecot.org/
admin_manual/list_of_events/#mail-index-recreated
lib-sql: Support TLS options for cassandra driver. This requires cpp-driver
v2.15 (or later) to work reliably.
lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now added to
existing mails if mail_attachment_detection_option=add-flags and it can be done
inexpensively.
login proxy: Added login_proxy_max_reconnects setting (default 3) to control
how many reconnections are attempted.
login proxy: imap/pop3/submission/managesieve proxying now supports
reconnection retrying on more than just connect() failure. Any error except a
non-temporary authentication failure will result in reconnect attempts.
auth: Lua passdb/userdb leaks stack elements per call, eventually causing the
stack to become too deep and crashing the auth or auth-worker process.
auth: SASL authentication PLAIN mechanism could be used to trigger read buffer
overflow. However, this doesn't seem to be exploitable in any way.
auth: v2.3.11 regression: GSSAPI authentication fails because dovecot disallows
NUL bytes for it.
dict: Process used too much CPU when iterating keys, because each key used a
separate write() syscall.
doveadm-server: Crash could occur if logging was done outside command handling.
For example http-client could have done debug logging afterwards, resulting in
either segfault or Panic: file http-client.c:
line 642 (http_client_context_close): assertion failed:
(cctx->clients_list == NULL).
doveadm-server: v2.3.11 regression: Trying to connect to doveadm server process
via starttls assert-crashed if there were no ssl=yes listeners:
Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
assertion failed: (service->ssl_ctx_initialized).
fts-solr: HTTP requests may have assert-crashed: Panic: file
http-client-request.c: line 1232 (http_client_request_send_more):
assertion failed: (req->payload_input != NULL)
imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
configuration that causes errors. Sending the error responses to the client can
cause the segmentation fault. This can for example happen when several
namespaces use the same mail storage location.
imap: IMAP NOTIFY used on a shared namespace that doesn't actually exist (e.g.
public namespace for a nonexistent user) can crash with a panic:
Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index:
Opened in (null):0
imap: IMAP session can crash with QRESYNC extension if many changes are done
before asking for expunged mails since last sync.
imap: Process might hang indefinitely if client disconnects after sending some
long-running commands pipelined, for example FETCH+LOGOUT.
lib-compress: Mitigate crashes when configuring a not compiled in compression.
Errors with compression configuration now distinguish between not supported and
unknown.
lib-compression: Using xz/lzma compression in v2.3.11 could have written
truncated output in some situations. This would result in "Broken pipe" read
errors when trying to read it back.
lib-compression: zstd compression could have crashed in some situations: Panic:
file ostream.c: line 287 (o_stream_sendv_int): assertion failed:
(!stream->blocking)
lib-dict: dict client could have crashed in some rare situations when iterating
keys.
lib-http: Fix several assert-crashes in HTTP client.
lib-index: v2.3.11 regression: When mails were expunged at the same time as
lots of new content was being saved to the cache (e.g. cache file was lost and
is being re-filled) a deadlock could occur with dovecot.index.cache /
dovecot.index.log.
lib-index: v2.3.11 regression: dovecot.index.cache file was being purged
(rewritten) too often when it had a field that hadn't been accessed for over 1
month, but less than 2 months. Every cache file change caused a purging in this
situation.
lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
Regression caused by fixing CVE-2020-12100.
lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE was
written in a way that may have caused confusion for both IMAP clients and
Dovecot itself when parsing it. The truncated part is now written out using
application/octet-stream MIME type.
lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the 10000th
MIME part was message/rfc822 (or if parent was multipart/digest): Panic: file
message-parser.c: line 167 (message_part_append): assertion failed: (ctx->
total_parts_count <= ctx->max_total_mime_parts).
lib-oauth2: Dovecot incorrectly required oauth2 server introspection reply to
contain username with invalid token.
lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has deprecated
APIs disabled.
lib-storage: When mail's size is different from the cached one (in
dovecot.index.cache or Maildir S=size in the filename), this is handled by
logging "Cached message size smaller/larger than expected" error. However, in
some situations this also ended up crashing with: Panic:
file istream.c: line 315 (i_stream_read_memarea): assertion failed:
(old_size <= _stream->pos - _stream->skip).
lib-storage: v2.3 regression: Copying/moving mails was taking much more memory
than before. This was mainly visible when copying/moving thousands of mails in
a single transaction.
lib-storage: v2.3.11 regression: Searching messages assert-crashed (without
FTS): Panic: file message-parser.c: line 174 (message_part_finish): assertion
failed: (ctx->nested_parts_count > 0).
lib: Dovecot v2.3 moved signal handlers around in ioloops, causing more CPU
usage than in v2.2.
lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted in error
if it happened to be at read boundary. Any NUL characters and '\u0000' will now
result in parsing error instead of silently truncating the data.
lmtp, submission: Server may hang if SSL client connection disconnects during
the delivery. If this happened repeated, it could have ended up reaching
process_limit and preventing any further lmtp/submission deliveries.
lmtp: Proxy does not always properly log TLS connection problems as errors; in
some cases, only a debug message is logged if enabled.
lmtp: The LMTP service can hang when commands are pipelined. This can
particularly occur when one command in the middle of the pipeline fails. One
example of this occurs for proxied LMTP transactions in which the final DATA or
BDAT command is pipelined after a failing RCPT command.
login-proxy: The login_source_ips setting has no effect, and therefore the
proxy source IPs are not cycled through as they should be.
master: Process was using 100% CPU in some situations when a broken service was
being throttled.
pop3-login: POP3 login would fail with "Input buffer full" if the initial
response for SASL was too long.
stats: Crash would occur when generating openmetrics data for metrics using
aggregating functions.
Update pigeonhole to version 0.5.15
o CVE-2020-28200: Sieve interpreter is not protected against abusive scripts
that claim excessive resource usage. Fixed by limiting the user CPU time
per single script execution and cumulatively over several script runs
within a configurable timeout period. Sufficiently large CPU time usage is
summed in the Sieve script binary and execution is blocked when the sum
exceeds the limit within that time. The block is lifted when the script is
updated after the resource usage times out. (bsc#1187420) Attacker can DoS
the mail delivery system (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
o Disconnection log messages are now more standardized across services. They
also always now start with "Disconnected" prefix.
o managesieve: Commands pipelined together with and just after the
authenticate command cause these commands to be executed twice.
o duplicate: The test was handled badly in a multiscript (sieve_before,
sieve_after) scenario in which an earlier script in the sequence with a
duplicate test succeeded, while a later script caused a runtime failure. In
that case, the message is recorded for duplicate tracking, while the
message may not actually have been delivered in the end.
o editheader: Sieve interpreter entered infinite loop at startup when the
"editheader" configuration listed an invalid header name. This problem can
only be triggered by the administrator.
o relational: The Sieve relational extension can cause a segfault at compile
time. This is triggered by invalid script syntax. The segfault happens when
this match type is the last argument of the test command. This situation is
not possible in a valid script; positional arguments are normally present
after that, which would prevent the segfault.
o sieve: For some Sieve commands the provided mailbox name is not properly
checked for UTF-8 validity, which can cause assert crashes at runtime when
an invalid mailbox name is encountered. This can be caused by the user by
writing a bad Sieve script involving the affected commands
("mailboxexists", "specialuse_exists"). This can be triggered by the remote
sender only when the user has written a Sieve script that passes message
content to one of the affected commands.
o sieve: Large sequences of 8-bit octets passed to certain Sieve commands
that create or modify message headers that allow UTF-8 text (vacation,
notify and addheader) can cause the delivery or IMAP process (when
IMAPSieve is used) to enter a memory-consuming semi-infinite loop that ends
when the process exceeds its memory limits. Logged in users can cause these
hangs only for their own processes.
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE Linux Enterprise Server for SAP 15:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2021-2890=1
o SUSE Linux Enterprise Server 15-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-2021-2890=1
o SUSE Linux Enterprise High Performance Computing 15-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2021-2890=1
o SUSE Linux Enterprise High Performance Computing 15-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2021-2890=1
Package List:
o SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64):
dovecot23-2.3.15-4.38.3
dovecot23-backend-mysql-2.3.15-4.38.3
dovecot23-backend-mysql-debuginfo-2.3.15-4.38.3
dovecot23-backend-pgsql-2.3.15-4.38.3
dovecot23-backend-pgsql-debuginfo-2.3.15-4.38.3
dovecot23-backend-sqlite-2.3.15-4.38.3
dovecot23-backend-sqlite-debuginfo-2.3.15-4.38.3
dovecot23-debuginfo-2.3.15-4.38.3
dovecot23-debugsource-2.3.15-4.38.3
dovecot23-devel-2.3.15-4.38.3
dovecot23-fts-2.3.15-4.38.3
dovecot23-fts-debuginfo-2.3.15-4.38.3
dovecot23-fts-lucene-2.3.15-4.38.3
dovecot23-fts-lucene-debuginfo-2.3.15-4.38.3
dovecot23-fts-solr-2.3.15-4.38.3
dovecot23-fts-solr-debuginfo-2.3.15-4.38.3
dovecot23-fts-squat-2.3.15-4.38.3
dovecot23-fts-squat-debuginfo-2.3.15-4.38.3
o SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x):
dovecot23-2.3.15-4.38.3
dovecot23-backend-mysql-2.3.15-4.38.3
dovecot23-backend-mysql-debuginfo-2.3.15-4.38.3
dovecot23-backend-pgsql-2.3.15-4.38.3
dovecot23-backend-pgsql-debuginfo-2.3.15-4.38.3
dovecot23-backend-sqlite-2.3.15-4.38.3
dovecot23-backend-sqlite-debuginfo-2.3.15-4.38.3
dovecot23-debuginfo-2.3.15-4.38.3
dovecot23-debugsource-2.3.15-4.38.3
dovecot23-devel-2.3.15-4.38.3
dovecot23-fts-2.3.15-4.38.3
dovecot23-fts-debuginfo-2.3.15-4.38.3
dovecot23-fts-lucene-2.3.15-4.38.3
dovecot23-fts-lucene-debuginfo-2.3.15-4.38.3
dovecot23-fts-solr-2.3.15-4.38.3
dovecot23-fts-solr-debuginfo-2.3.15-4.38.3
dovecot23-fts-squat-2.3.15-4.38.3
dovecot23-fts-squat-debuginfo-2.3.15-4.38.3
o SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64):
dovecot23-2.3.15-4.38.3
dovecot23-backend-mysql-2.3.15-4.38.3
dovecot23-backend-mysql-debuginfo-2.3.15-4.38.3
dovecot23-backend-pgsql-2.3.15-4.38.3
dovecot23-backend-pgsql-debuginfo-2.3.15-4.38.3
dovecot23-backend-sqlite-2.3.15-4.38.3
dovecot23-backend-sqlite-debuginfo-2.3.15-4.38.3
dovecot23-debuginfo-2.3.15-4.38.3
dovecot23-debugsource-2.3.15-4.38.3
dovecot23-devel-2.3.15-4.38.3
dovecot23-fts-2.3.15-4.38.3
dovecot23-fts-debuginfo-2.3.15-4.38.3
dovecot23-fts-lucene-2.3.15-4.38.3
dovecot23-fts-lucene-debuginfo-2.3.15-4.38.3
dovecot23-fts-solr-2.3.15-4.38.3
dovecot23-fts-solr-debuginfo-2.3.15-4.38.3
dovecot23-fts-squat-2.3.15-4.38.3
dovecot23-fts-squat-debuginfo-2.3.15-4.38.3
o SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64):
dovecot23-2.3.15-4.38.3
dovecot23-backend-mysql-2.3.15-4.38.3
dovecot23-backend-mysql-debuginfo-2.3.15-4.38.3
dovecot23-backend-pgsql-2.3.15-4.38.3
dovecot23-backend-pgsql-debuginfo-2.3.15-4.38.3
dovecot23-backend-sqlite-2.3.15-4.38.3
dovecot23-backend-sqlite-debuginfo-2.3.15-4.38.3
dovecot23-debuginfo-2.3.15-4.38.3
dovecot23-debugsource-2.3.15-4.38.3
dovecot23-devel-2.3.15-4.38.3
dovecot23-fts-2.3.15-4.38.3
dovecot23-fts-debuginfo-2.3.15-4.38.3
dovecot23-fts-lucene-2.3.15-4.38.3
dovecot23-fts-lucene-debuginfo-2.3.15-4.38.3
dovecot23-fts-solr-2.3.15-4.38.3
dovecot23-fts-solr-debuginfo-2.3.15-4.38.3
dovecot23-fts-squat-2.3.15-4.38.3
dovecot23-fts-squat-debuginfo-2.3.15-4.38.3
References:
o https://www.suse.com/security/cve/CVE-2020-28200.html
o https://www.suse.com/security/cve/CVE-2021-29157.html
o https://bugzilla.suse.com/1187418
o https://bugzilla.suse.com/1187419
o https://bugzilla.suse.com/1187420
- --------------------------------------------------------------------------------
SUSE Security Update: Security update for dovecot23
______________________________________________________________________________
Announcement ID: SUSE-SU-2021:2892-1
Rating: moderate
References: #1187418 #1187419 #1187420
Cross-References: CVE-2020-28200 CVE-2021-29157
Affected Products:
SUSE Linux Enterprise Module for Server Applications 15-SP3
SUSE Linux Enterprise Module for Server Applications 15-SP2
______________________________________________________________________________
An update that solves two vulnerabilities, contains one feature and has one
errata is now available.
Description:
This update for dovecot23 fixes the following issues:
Update dovecot to version 2.3.15 (jsc#SLE-19970):
Security issues fixed:
o CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT
tokens. This may be used to supply attacker controlled keys to validate
tokens, if attacker has local access. (bsc#1187418) Local attacker can
login as any user and access their emails
o CVE-2021-33515: On-path attacker could have injected plaintext commands
before STARTTLS negotiation that would be executed after STARTTLS finished
with the client. (bsc#1187419) Attacker can potentially steal user
credentials and mails
o Disconnection log messages are now more standardized across services. They
also always now start with "Disconnected" prefix.
o Dovecot now depends on libsystemd for systemd integration.
o Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
o config: Some settings are now marked as "hidden". It's discouraged to
change these settings. They will no longer be visible in doveconf output,
except if they have been changed or if doveconf -s parameter is used. See
https://doc.dovecot.org/settings/advanced/ for details.
o imap-compress: Compression level is now algorithm specific. See https://
doc.dovecot.org/settings/plugin/compress-plugin/
o indexer-worker: Convert "Indexed" info logs to an event named
"indexer_worker_indexing_finished". See
https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexin
g-finished
Add TSLv1.3 support to min_protocols.
Allow configuring ssl_cipher_suites. (for TLSv1.3+)
acl: Add acl_ignore_namespace setting which allows to entirely ignore ACLs for
the listed namespaces.
imap: Support official RFC8970 preview/snippet syntax. Old methods of
retrieving preview information via IMAP commands ("SNIPPET and PREVIEW with
explicit algorithm selection") have been deprecated.
imapc: Support INDEXPVT for imapc storage to enable private message flags for
cluster wide shared mailboxes.
lib-storage: Add new events: mail_opened, mail_expunge_requested,
mail_expunged, mail_cache_lookup_finished. See https://doc.dovecot.org/
admin_manual/list_of_events/#mail
zlib, imap-compression, fs-compress: Support compression levels that the
algorithm supports. Before, we would allow hardcoded value between 1 to 9 and
would default to 6. Now we allow using per-algorithm value range and default to
whatever default the algorithm specifies.
*-login: Commands pipelined together with and just after the authenticate
command cause these commands to be executed twice. This applies to all
protocols that involve user login, which currently comprises of imap, pop3,
submisision and managesieve.
*-login: Processes are supposed to disconnect the oldest non-logged in
connection when process_limit was reached. This didn't actually happen with the
default "high-security mode" (with service_count=1) where each connection is
handled by a separate process.
*-login: When login process reaches client/process limits, oldest client
connections are disconnected. If one of these was still doing anvil lookup,
this caused a crash. This could happen only if the login process limits were
very low or if the server was overloaded.
Fixed building with link time optimizations (-flto).
auth: Userdb iteration with passwd driver does not always return all users with
some nss drivers.
dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was disabled.
If a user has a shared mailbox which is another user's INBOX, dsync didn't
include the mailbox in syncing unless explicit naming is enabled with
"mail_shared_explicit_inbox" set to "yes".
dsync: Shared namespaces were not synced with "-n" flag.
dsync: Syncing shared INBOX failed if mail_attribute_dict was not set. If a
user has a shared mailbox that is another user's INBOX, dsync failed to export
the mailbox if mail attributes are disabled.
fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP requests
to assert-crash: Panic: file http-client-request.c: line 1232
(http_client_request_send_more): assertion failed: (req->payload_input != NULL)
fts-tika: 5xx errors returned by Tika server as indexing failures. However,
Tika can return 5xx for some attachments every time. So the 5xx error should be
retried once, but treated as success if it happens on the retry as well. v2.3
regression.
fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have resulted
in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
assertion failed:
(ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input))
imap: SETMETADATA could not be used to unset metadata values. Instead NIL was
handled as a "NIL" string. v2.3.14 regression.
imap: IMAP BINARY FETCH crashes at least on empty base64 body: Panic: file
index-mail-binary.c: line 358 (blocks_count_lines): assertion failed:
(block_count == 0 || block_idx+1 == block_count)
imap: If IMAP client using the NOTIFY command was disconnected while sending
FETCH notifications to the client, imap could crash with Panic:
Trying to close mailbox INBOX with open transactions.
imap: Using IMAP COMPRESS extension can cause IMAP connection to hang when IMAP
commands are >8 kB long.
imapc: If remote server sent BYE but didn't immediately disconnect, it could
cause infinite busy-loop.
lib-index: Corrupted cache record size in dovecot.index.cache file could have
caused a crash (segfault) when accessing it.
lib-oauth2: JWT token time validation now works correctly with 32-bit systems.
lib-ssl-iostream: Checking hostnames against an SSL certificate was
case-sensitive.
lib-storage: Corrupted mime.parts in dovecot.index.cache may have resulted in
Panic: file imap-bodystructure.c: line 206 (part_write_body): assertion failed:
(text == ((part->flags & MESSAGE_PART_FLAG_TEXT) != 0))
lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't preserve
the "hdr-pop3-uidl" header. Because of this, the next pop3 session could have
accessed all of the emails' metadata to read their POP3 UIDL (opening dbox
files).
listescape: When using the listescape plugin and a shared namespace the plugin
didn't work properly anymore resulting in errors like: "Invalid mailbox name:
Name must not have '/' character."
lmtp: Connection crashes if connection gets disconnected due to multiple bad
commands and the last bad command is BDAT.
lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly forwarded by
LMTP proxy without checking that the backend has support. This caused a command
parameter error from the backend if it was running an older Dovecot release.
This could only occur in more complex setups where the message was proxied
twice; when the proxy generated the XRCPTFORWARD parameter itself the problem
did not occur, so this only happened when it was forwarded.
lmtp: The LMTP proxy crashes with a panic when the remote server replies with
an error while the mail is still being forwarded through a DATA/BDAT command.
lmtp: Username may have been missing from lmtp log line prefixes when it was
performing autoexpunging.
master: Dovecot would incorrectly fail with haproxy 2.0.14 service checks.
master: Systemd service: Dovecot announces readiness for accepting connections
earlier than it should. The following environment variables are now imported
automatically and can be omitted from import_environment setting: NOTIFY_SOCKET
LISTEN_FDS LISTEN_PID.
master: service { process_min_avail } was launching processes too slowly when
master was forking a lot of processes.
util: Make the health-check.sh example script POSIX shell compatible.
Added new aliases for some variables. Usage of the old ones is possible, but
discouraged. (These were partially added already to v2.3.13.) See https://
doc.dovecot.org/configuration_manual/config_file/config_variables/ for more
information.
Optimize imap/pop3/submission/managesieve proxies to use less CPU at the cost
of extra memory usage.
Remove autocreate, expire, snarf and mail-filter plugins.
Remove cydir storage driver.
Remove XZ/LZMA write support. Read support will be removed in future release.
doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
environment variable is not set. Timestamp format is taken from log_timestamp
setting.
If BROKENCHAR or listescape plugin is used, the escaped folder names may be
slightly different from before in some situations. This is unlikely to cause
issues, although caching clients may redownload the folders.
imapc: It now enables BROKENCHAR=~ by default to escape remote folder names if
necessary. This also means that if there are any '~' characters in the remote
folder names, they will be visible as "~7e".
imapc: When using local index files folder names were escaped on filesystem a
bit differently. This affects only if there are folder names that actually
require escaping, which isn't so common. The old style folders will be
automatically deleted from filesystem.
stats: Update exported metrics to be compliant with OpenMetrics standard.
doveadm: Add an optional '-p' parameter to metadata list command. If enabled, "
/private", and "/shared" metadata prefixes will be prepended to the keys in the
list output.
doveconf: Support environment variables in config files. See https://
doc.dovecot.org/configuration_manual/config_file/config_file_syntax /#
environment-variables for more details.
indexer-worker: Change indexer to disconnect from indexer-worker after each
request. This allows service indexer-worker's service_count & idle_kill
settings to work. These can be used to restart indexer-worker processes once in
a while to reduce their memory usage.
auth: "nodelay" with various authentication mechanisms such as apop and
digest-md5 crashed AUTH process if authentication failed.
auth: Auth lua script generating an error triggered an assertion failure:
Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
assertion failed: (lua_gettop(script->L) == 0).
configure: Fix libunwind detection to work on other than x86_64 systems.
doveadm-server: Process could crash if logging was done outside command
handling. For example http-client could have done debug logging afterwards,
resulting in either segfault or Panic: file http-client.c:
line 642 (http_client_context_close): assertion failed:
(cctx->clients_list == NULL).
dsync: Folder name escaping with BROKENCHAR didn't work completely correctly.
This especially caused problems with dsync-migrations using imapc where some of
the remote folder names may not have been accessible.
dsync: doveadm sync + imapc doesn't always sync all mails when doing an
incremental sync (-1), which could lead to mail loss when it's used for
migration. This happens only when GUIDs aren't used (i.e. imapc without
imapc_features=guid-forced).
fts-tika: When tika server returns error, some mails cause Panic: file
message-parser.c: line 802 (message_parser_deinit_from_parts): assertion
failed: (ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input))
lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have resulted in
crashes. This exposed that Dovecot was wrongly accepting atoms in "nstring"
handling. Changed the IMAP parsing to be more strict about this now.
lib-index: If dovecot.index.cache has corrupted message size, fetching BODY/
BODYSTRUCTURE may cause assert-crash: Panic: file index-mail.c:
line 1140 (index_mail_parse_body_finish): assertion failed:
(mail->data.parts != NULL).
lib-index: Minor error handling and race condition fixes related to rotating
dovecot.index.log. These didn't usually cause problems, unless the log files
were rotated rapidly.
lib-lua: Lua scripts using coroutines or lua libraries using coroutines (e.g.,
cqueues) panicked.
Message PREVIEW handled whitespace wrong so first space would get eaten from
between words.
FTS and message PREVIEW (snippet) parsed HTML &entities case-sensitively.
lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE was
written in a way that may have caused confusion for IMAP clients and also
Dovecot itself when parsing it. The truncated part is now written out using
application/octet-stream MIME type.
lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to use
them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
(meth->context_size <= MAC_MAX_CONTEXT_SIZE).
event filters: NOT keyword did not have the correct associativity.
Ignore ECONNRESET when closing socket. This avoids logging useless errors on
systems like FreeBSD.
event filters: event filter syntax error may lead to Panic: file
event-filter.c: line 137 (event_filter_parse): assertion failed:
(state.output == NULL)
lib: timeval_cmp_margin() was broken on 32-bit systems. This could potentially
have caused HTTP timeouts to be handled incorrectly.
log: instance_name wasn't used as syslog ident by the log process.
master: After a service reached process_limit and client_limit, it could have
taken up to 1 second to realize that more client connections became available.
During this time client connections could have been unnecessarily rejected and
a warning logged: Warning: service(...):
process_limit (...) reached, client connections are being dropped
stats: Crash would occur when generating openmetrics data for metrics using
aggregating functions.
stats: Event filters comparing against empty strings crash the stats process.
CVE-2020-24386: Specially crafted command can cause IMAP hibernate to allow
logged in user to access other people's emails and filesystem information.
Metric filter and global event filter variable syntax changed to a SQL-like
format. See https://doc.dovecot.org/configuration_manual/event_filter/
auth: Added new aliases for %{variables}. Usage of the old ones is possible,
but discouraged.
auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth mechanism and
related password schemes.
auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
auth: Removed postfix postmap socket
auth: Added new fields for auth server events. These fields are now also
available for all auth events. See https://doc.dovecot.org/admin_manual/
list_of_events/#authentication-server for details.
imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated and
imap_client_unhibernate_retried events. See https://doc.dovecot.org/
admin_manual/list_of_events/ for details.
lib-index: Added new mail_index_recreated event. See https://doc.dovecot.org/
admin_manual/list_of_events/#mail-index-recreated
lib-sql: Support TLS options for cassandra driver. This requires cpp-driver
v2.15 (or later) to work reliably.
lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now added to
existing mails if mail_attachment_detection_option=add-flags and it can be done
inexpensively.
login proxy: Added login_proxy_max_reconnects setting (default 3) to control
how many reconnections are attempted.
login proxy: imap/pop3/submission/managesieve proxying now supports
reconnection retrying on more than just connect() failure. Any error except a
non-temporary authentication failure will result in reconnect attempts.
auth: Lua passdb/userdb leaks stack elements per call, eventually causing the
stack to become too deep and crashing the auth or auth-worker process.
auth: SASL authentication PLAIN mechanism could be used to trigger read buffer
overflow. However, this doesn't seem to be exploitable in any way.
auth: v2.3.11 regression: GSSAPI authentication fails because dovecot disallows
NUL bytes for it.
dict: Process used too much CPU when iterating keys, because each key used a
separate write() syscall.
doveadm-server: Crash could occur if logging was done outside command handling.
For example http-client could have done debug logging afterwards, resulting in
either segfault or Panic: file http-client.c:
line 642 (http_client_context_close): assertion failed:
(cctx->clients_list == NULL).
doveadm-server: v2.3.11 regression: Trying to connect to doveadm server process
via starttls assert-crashed if there were no ssl=yes listeners:
Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
assertion failed: (service->ssl_ctx_initialized).
fts-solr: HTTP requests may have assert-crashed: Panic: file
http-client-request.c: line 1232 (http_client_request_send_more):
assertion failed: (req->payload_input != NULL)
imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
configuration that causes errors. Sending the error responses to the client can
cause the segmentation fault. This can for example happen when several
namespaces use the same mail storage location.
imap: IMAP NOTIFY used on a shared namespace that doesn't actually exist (e.g.
public namespace for a nonexistent user) can crash with a panic:
Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index:
Opened in (null):0
imap: IMAP session can crash with QRESYNC extension if many changes are done
before asking for expunged mails since last sync.
imap: Process might hang indefinitely if client disconnects after sending some
long-running commands pipelined, for example FETCH+LOGOUT.
lib-compress: Mitigate crashes when configuring a not compiled in compression.
Errors with compression configuration now distinguish between not supported and
unknown.
lib-compression: Using xz/lzma compression in v2.3.11 could have written
truncated output in some situations. This would result in "Broken pipe" read
errors when trying to read it back.
lib-compression: zstd compression could have crashed in some situations: Panic:
file ostream.c: line 287 (o_stream_sendv_int): assertion failed:
(!stream->blocking)
lib-dict: dict client could have crashed in some rare situations when iterating
keys.
lib-http: Fix several assert-crashes in HTTP client.
lib-index: v2.3.11 regression: When mails were expunged at the same time as
lots of new content was being saved to the cache (e.g. cache file was lost and
is being re-filled) a deadlock could occur with dovecot.index.cache /
dovecot.index.log.
lib-index: v2.3.11 regression: dovecot.index.cache file was being purged
(rewritten) too often when it had a field that hadn't been accessed for over 1
month, but less than 2 months. Every cache file change caused a purging in this
situation.
lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
Regression caused by fixing CVE-2020-12100.
lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE was
written in a way that may have caused confusion for both IMAP clients and
Dovecot itself when parsing it. The truncated part is now written out using
application/octet-stream MIME type.
lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the 10000th
MIME part was message/rfc822 (or if parent was multipart/digest): Panic: file
message-parser.c: line 167 (message_part_append): assertion failed: (ctx->
total_parts_count <= ctx->max_total_mime_parts).
lib-oauth2: Dovecot incorrectly required oauth2 server introspection reply to
contain username with invalid token.
lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has deprecated
APIs disabled.
lib-storage: When mail's size is different from the cached one (in
dovecot.index.cache or Maildir S=size in the filename), this is handled by
logging "Cached message size smaller/larger than expected" error. However, in
some situations this also ended up crashing with: Panic:
file istream.c: line 315 (i_stream_read_memarea): assertion failed:
(old_size <= _stream->pos - _stream->skip).
lib-storage: v2.3 regression: Copying/moving mails was taking much more memory
than before. This was mainly visible when copying/moving thousands of mails in
a single transaction.
lib-storage: v2.3.11 regression: Searching messages assert-crashed (without
FTS): Panic: file message-parser.c: line 174 (message_part_finish): assertion
failed: (ctx->nested_parts_count > 0).
lib: Dovecot v2.3 moved signal handlers around in ioloops, causing more CPU
usage than in v2.2.
lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted in error
if it happened to be at read boundary. Any NUL characters and '\u0000' will now
result in parsing error instead of silently truncating the data.
lmtp, submission: Server may hang if SSL client connection disconnects during
the delivery. If this happened repeated, it could have ended up reaching
process_limit and preventing any further lmtp/submission deliveries.
lmtp: Proxy does not always properly log TLS connection problems as errors; in
some cases, only a debug message is logged if enabled.
lmtp: The LMTP service can hang when commands are pipelined. This can
particularly occur when one command in the middle of the pipeline fails. One
example of this occurs for proxied LMTP transactions in which the final DATA or
BDAT command is pipelined after a failing RCPT command.
login-proxy: The login_source_ips setting has no effect, and therefore the
proxy source IPs are not cycled through as they should be.
master: Process was using 100% CPU in some situations when a broken service was
being throttled.
pop3-login: POP3 login would fail with "Input buffer full" if the initial
response for SASL was too long.
stats: Crash would occur when generating openmetrics data for metrics using
aggregating functions.
Update pigeonhole to version 0.5.15
o CVE-2020-28200: Sieve interpreter is not protected against abusive scripts
that claim excessive resource usage. Fixed by limiting the user CPU time
per single script execution and cumulatively over several script runs
within a configurable timeout period. Sufficiently large CPU time usage is
summed in the Sieve script binary and execution is blocked when the sum
exceeds the limit within that time. The block is lifted when the script is
updated after the resource usage times out. (bsc#1187420) Attacker can DoS
the mail delivery system (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
o Disconnection log messages are now more standardized across services. They
also always now start with "Disconnected" prefix.
o managesieve: Commands pipelined together with and just after the
authenticate command cause these commands to be executed twice.
o duplicate: The test was handled badly in a multiscript (sieve_before,
sieve_after) scenario in which an earlier script in the sequence with a
duplicate test succeeded, while a later script caused a runtime failure. In
that case, the message is recorded for duplicate tracking, while the
message may not actually have been delivered in the end.
o editheader: Sieve interpreter entered infinite loop at startup when the
"editheader" configuration listed an invalid header name. This problem can
only be triggered by the administrator.
o relational: The Sieve relational extension can cause a segfault at compile
time. This is triggered by invalid script syntax. The segfault happens when
this match type is the last argument of the test command. This situation is
not possible in a valid script; positional arguments are normally present
after that, which would prevent the segfault.
o sieve: For some Sieve commands the provided mailbox name is not properly
checked for UTF-8 validity, which can cause assert crashes at runtime when
an invalid mailbox name is encountered. This can be caused by the user by
writing a bad Sieve script involving the affected commands
("mailboxexists", "specialuse_exists"). This can be triggered by the remote
sender only when the user has written a Sieve script that passes message
content to one of the affected commands.
o sieve: Large sequences of 8-bit octets passed to certain Sieve commands
that create or modify message headers that allow UTF-8 text (vacation,
notify and addheader) can cause the delivery or IMAP process (when
IMAPSieve is used) to enter a memory-consuming semi-infinite loop that ends
when the process exceeds its memory limits. Logged in users can cause these
hangs only for their own processes.
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE Linux Enterprise Module for Server Applications 15-SP3:
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2021-2892=1
o SUSE Linux Enterprise Module for Server Applications 15-SP2:
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP2-2021-2892=1
Package List:
o SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64
ppc64le s390x x86_64):
dovecot23-2.3.15-58.3
dovecot23-backend-mysql-2.3.15-58.3
dovecot23-backend-mysql-debuginfo-2.3.15-58.3
dovecot23-backend-pgsql-2.3.15-58.3
dovecot23-backend-pgsql-debuginfo-2.3.15-58.3
dovecot23-backend-sqlite-2.3.15-58.3
dovecot23-backend-sqlite-debuginfo-2.3.15-58.3
dovecot23-debuginfo-2.3.15-58.3
dovecot23-debugsource-2.3.15-58.3
dovecot23-devel-2.3.15-58.3
dovecot23-fts-2.3.15-58.3
dovecot23-fts-debuginfo-2.3.15-58.3
dovecot23-fts-lucene-2.3.15-58.3
dovecot23-fts-lucene-debuginfo-2.3.15-58.3
dovecot23-fts-solr-2.3.15-58.3
dovecot23-fts-solr-debuginfo-2.3.15-58.3
dovecot23-fts-squat-2.3.15-58.3
dovecot23-fts-squat-debuginfo-2.3.15-58.3
o SUSE Linux Enterprise Module for Server Applications 15-SP2 (aarch64
ppc64le s390x x86_64):
dovecot23-2.3.15-58.3
dovecot23-backend-mysql-2.3.15-58.3
dovecot23-backend-mysql-debuginfo-2.3.15-58.3
dovecot23-backend-pgsql-2.3.15-58.3
dovecot23-backend-pgsql-debuginfo-2.3.15-58.3
dovecot23-backend-sqlite-2.3.15-58.3
dovecot23-backend-sqlite-debuginfo-2.3.15-58.3
dovecot23-debuginfo-2.3.15-58.3
dovecot23-debugsource-2.3.15-58.3
dovecot23-devel-2.3.15-58.3
dovecot23-fts-2.3.15-58.3
dovecot23-fts-debuginfo-2.3.15-58.3
dovecot23-fts-lucene-2.3.15-58.3
dovecot23-fts-lucene-debuginfo-2.3.15-58.3
dovecot23-fts-solr-2.3.15-58.3
dovecot23-fts-solr-debuginfo-2.3.15-58.3
dovecot23-fts-squat-2.3.15-58.3
dovecot23-fts-squat-debuginfo-2.3.15-58.3
References:
o https://www.suse.com/security/cve/CVE-2020-28200.html
o https://www.suse.com/security/cve/CVE-2021-29157.html
o https://bugzilla.suse.com/1187418
o https://bugzilla.suse.com/1187419
o https://bugzilla.suse.com/1187420
- --------------------------------------------------------------------------------
SUSE Security Update: Security update for dovecot23
______________________________________________________________________________
Announcement ID: SUSE-SU-2021:2891-1
Rating: moderate
References: #1187418 #1187419 #1187420
Cross-References: CVE-2020-28200 CVE-2021-29157
Affected Products:
SUSE Manager Server 4.0
SUSE Manager Retail Branch Server 4.0
SUSE Manager Proxy 4.0
SUSE Linux Enterprise Server for SAP 15-SP1
SUSE Linux Enterprise Server 15-SP1-LTSS
SUSE Linux Enterprise Server 15-SP1-BCL
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS
SUSE Enterprise Storage 6
SUSE CaaS Platform 4.0
______________________________________________________________________________
An update that solves two vulnerabilities, contains one feature and has one
errata is now available.
Description:
This update for dovecot23 fixes the following issues:
Update dovecot to version 2.3.15 (jsc#SLE-19970):
Security issues fixed:
o CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT
tokens. This may be used to supply attacker controlled keys to validate
tokens, if attacker has local access. (bsc#1187418) Local attacker can
login as any user and access their emails
o CVE-2021-33515: On-path attacker could have injected plaintext commands
before STARTTLS negotiation that would be executed after STARTTLS finished
with the client. (bsc#1187419) Attacker can potentially steal user
credentials and mails
o Disconnection log messages are now more standardized across services. They
also always now start with "Disconnected" prefix.
o Dovecot now depends on libsystemd for systemd integration.
o Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
o config: Some settings are now marked as "hidden". It's discouraged to
change these settings. They will no longer be visible in doveconf output,
except if they have been changed or if doveconf -s parameter is used. See
https://doc.dovecot.org/settings/advanced/ for details.
o imap-compress: Compression level is now algorithm specific. See https://
doc.dovecot.org/settings/plugin/compress-plugin/
o indexer-worker: Convert "Indexed" info logs to an event named
"indexer_worker_indexing_finished". See
https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexin
g-finished
Add TSLv1.3 support to min_protocols.
Allow configuring ssl_cipher_suites. (for TLSv1.3+)
acl: Add acl_ignore_namespace setting which allows to entirely ignore ACLs for
the listed namespaces.
imap: Support official RFC8970 preview/snippet syntax. Old methods of
retrieving preview information via IMAP commands ("SNIPPET and PREVIEW with
explicit algorithm selection") have been deprecated.
imapc: Support INDEXPVT for imapc storage to enable private message flags for
cluster wide shared mailboxes.
lib-storage: Add new events: mail_opened, mail_expunge_requested,
mail_expunged, mail_cache_lookup_finished. See https://doc.dovecot.org/
admin_manual/list_of_events/#mail
zlib, imap-compression, fs-compress: Support compression levels that the
algorithm supports. Before, we would allow hardcoded value between 1 to 9 and
would default to 6. Now we allow using per-algorithm value range and default to
whatever default the algorithm specifies.
*-login: Commands pipelined together with and just after the authenticate
command cause these commands to be executed twice. This applies to all
protocols that involve user login, which currently comprises of imap, pop3,
submisision and managesieve.
*-login: Processes are supposed to disconnect the oldest non-logged in
connection when process_limit was reached. This didn't actually happen with the
default "high-security mode" (with service_count=1) where each connection is
handled by a separate process.
*-login: When login process reaches client/process limits, oldest client
connections are disconnected. If one of these was still doing anvil lookup,
this caused a crash. This could happen only if the login process limits were
very low or if the server was overloaded.
Fixed building with link time optimizations (-flto).
auth: Userdb iteration with passwd driver does not always return all users with
some nss drivers.
dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was disabled.
If a user has a shared mailbox which is another user's INBOX, dsync didn't
include the mailbox in syncing unless explicit naming is enabled with
"mail_shared_explicit_inbox" set to "yes".
dsync: Shared namespaces were not synced with "-n" flag.
dsync: Syncing shared INBOX failed if mail_attribute_dict was not set. If a
user has a shared mailbox that is another user's INBOX, dsync failed to export
the mailbox if mail attributes are disabled.
fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP requests
to assert-crash: Panic: file http-client-request.c: line 1232
(http_client_request_send_more): assertion failed: (req->payload_input != NULL)
fts-tika: 5xx errors returned by Tika server as indexing failures. However,
Tika can return 5xx for some attachments every time. So the 5xx error should be
retried once, but treated as success if it happens on the retry as well. v2.3
regression.
fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have resulted
in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
assertion failed:
(ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input))
imap: SETMETADATA could not be used to unset metadata values. Instead NIL was
handled as a "NIL" string. v2.3.14 regression.
imap: IMAP BINARY FETCH crashes at least on empty base64 body: Panic: file
index-mail-binary.c: line 358 (blocks_count_lines): assertion failed:
(block_count == 0 || block_idx+1 == block_count)
imap: If IMAP client using the NOTIFY command was disconnected while sending
FETCH notifications to the client, imap could crash with Panic:
Trying to close mailbox INBOX with open transactions.
imap: Using IMAP COMPRESS extension can cause IMAP connection to hang when IMAP
commands are >8 kB long.
imapc: If remote server sent BYE but didn't immediately disconnect, it could
cause infinite busy-loop.
lib-index: Corrupted cache record size in dovecot.index.cache file could have
caused a crash (segfault) when accessing it.
lib-oauth2: JWT token time validation now works correctly with 32-bit systems.
lib-ssl-iostream: Checking hostnames against an SSL certificate was
case-sensitive.
lib-storage: Corrupted mime.parts in dovecot.index.cache may have resulted in
Panic: file imap-bodystructure.c: line 206 (part_write_body): assertion failed:
(text == ((part->flags & MESSAGE_PART_FLAG_TEXT) != 0))
lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't preserve
the "hdr-pop3-uidl" header. Because of this, the next pop3 session could have
accessed all of the emails' metadata to read their POP3 UIDL (opening dbox
files).
listescape: When using the listescape plugin and a shared namespace the plugin
didn't work properly anymore resulting in errors like: "Invalid mailbox name:
Name must not have '/' character."
lmtp: Connection crashes if connection gets disconnected due to multiple bad
commands and the last bad command is BDAT.
lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly forwarded by
LMTP proxy without checking that the backend has support. This caused a command
parameter error from the backend if it was running an older Dovecot release.
This could only occur in more complex setups where the message was proxied
twice; when the proxy generated the XRCPTFORWARD parameter itself the problem
did not occur, so this only happened when it was forwarded.
lmtp: The LMTP proxy crashes with a panic when the remote server replies with
an error while the mail is still being forwarded through a DATA/BDAT command.
lmtp: Username may have been missing from lmtp log line prefixes when it was
performing autoexpunging.
master: Dovecot would incorrectly fail with haproxy 2.0.14 service checks.
master: Systemd service: Dovecot announces readiness for accepting connections
earlier than it should. The following environment variables are now imported
automatically and can be omitted from import_environment setting: NOTIFY_SOCKET
LISTEN_FDS LISTEN_PID.
master: service { process_min_avail } was launching processes too slowly when
master was forking a lot of processes.
util: Make the health-check.sh example script POSIX shell compatible.
Added new aliases for some variables. Usage of the old ones is possible, but
discouraged. (These were partially added already to v2.3.13.) See https://
doc.dovecot.org/configuration_manual/config_file/config_variables/ for more
information.
Optimize imap/pop3/submission/managesieve proxies to use less CPU at the cost
of extra memory usage.
Remove autocreate, expire, snarf and mail-filter plugins.
Remove cydir storage driver.
Remove XZ/LZMA write support. Read support will be removed in future release.
doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
environment variable is not set. Timestamp format is taken from log_timestamp
setting.
If BROKENCHAR or listescape plugin is used, the escaped folder names may be
slightly different from before in some situations. This is unlikely to cause
issues, although caching clients may redownload the folders.
imapc: It now enables BROKENCHAR=~ by default to escape remote folder names if
necessary. This also means that if there are any '~' characters in the remote
folder names, they will be visible as "~7e".
imapc: When using local index files folder names were escaped on filesystem a
bit differently. This affects only if there are folder names that actually
require escaping, which isn't so common. The old style folders will be
automatically deleted from filesystem.
stats: Update exported metrics to be compliant with OpenMetrics standard.
doveadm: Add an optional '-p' parameter to metadata list command. If enabled, "
/private", and "/shared" metadata prefixes will be prepended to the keys in the
list output.
doveconf: Support environment variables in config files. See https://
doc.dovecot.org/configuration_manual/config_file/config_file_syntax /#
environment-variables for more details.
indexer-worker: Change indexer to disconnect from indexer-worker after each
request. This allows service indexer-worker's service_count & idle_kill
settings to work. These can be used to restart indexer-worker processes once in
a while to reduce their memory usage.
auth: "nodelay" with various authentication mechanisms such as apop and
digest-md5 crashed AUTH process if authentication failed.
auth: Auth lua script generating an error triggered an assertion failure:
Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
assertion failed: (lua_gettop(script->L) == 0).
configure: Fix libunwind detection to work on other than x86_64 systems.
doveadm-server: Process could crash if logging was done outside command
handling. For example http-client could have done debug logging afterwards,
resulting in either segfault or Panic: file http-client.c:
line 642 (http_client_context_close): assertion failed:
(cctx->clients_list == NULL).
dsync: Folder name escaping with BROKENCHAR didn't work completely correctly.
This especially caused problems with dsync-migrations using imapc where some of
the remote folder names may not have been accessible.
dsync: doveadm sync + imapc doesn't always sync all mails when doing an
incremental sync (-1), which could lead to mail loss when it's used for
migration. This happens only when GUIDs aren't used (i.e. imapc without
imapc_features=guid-forced).
fts-tika: When tika server returns error, some mails cause Panic: file
message-parser.c: line 802 (message_parser_deinit_from_parts): assertion
failed: (ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input))
lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have resulted in
crashes. This exposed that Dovecot was wrongly accepting atoms in "nstring"
handling. Changed the IMAP parsing to be more strict about this now.
lib-index: If dovecot.index.cache has corrupted message size, fetching BODY/
BODYSTRUCTURE may cause assert-crash: Panic: file index-mail.c:
line 1140 (index_mail_parse_body_finish): assertion failed:
(mail->data.parts != NULL).
lib-index: Minor error handling and race condition fixes related to rotating
dovecot.index.log. These didn't usually cause problems, unless the log files
were rotated rapidly.
lib-lua: Lua scripts using coroutines or lua libraries using coroutines (e.g.,
cqueues) panicked.
Message PREVIEW handled whitespace wrong so first space would get eaten from
between words.
FTS and message PREVIEW (snippet) parsed HTML &entities case-sensitively.
lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE was
written in a way that may have caused confusion for IMAP clients and also
Dovecot itself when parsing it. The truncated part is now written out using
application/octet-stream MIME type.
lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to use
them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
(meth->context_size <= MAC_MAX_CONTEXT_SIZE).
event filters: NOT keyword did not have the correct associativity.
Ignore ECONNRESET when closing socket. This avoids logging useless errors on
systems like FreeBSD.
event filters: event filter syntax error may lead to Panic: file
event-filter.c: line 137 (event_filter_parse): assertion failed:
(state.output == NULL)
lib: timeval_cmp_margin() was broken on 32-bit systems. This could potentially
have caused HTTP timeouts to be handled incorrectly.
log: instance_name wasn't used as syslog ident by the log process.
master: After a service reached process_limit and client_limit, it could have
taken up to 1 second to realize that more client connections became available.
During this time client connections could have been unnecessarily rejected and
a warning logged: Warning: service(...):
process_limit (...) reached, client connections are being dropped
stats: Crash would occur when generating openmetrics data for metrics using
aggregating functions.
stats: Event filters comparing against empty strings crash the stats process.
CVE-2020-24386: Specially crafted command can cause IMAP hibernate to allow
logged in user to access other people's emails and filesystem information.
Metric filter and global event filter variable syntax changed to a SQL-like
format. See https://doc.dovecot.org/configuration_manual/event_filter/
auth: Added new aliases for %{variables}. Usage of the old ones is possible,
but discouraged.
auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth mechanism and
related password schemes.
auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
auth: Removed postfix postmap socket
auth: Added new fields for auth server events. These fields are now also
available for all auth events. See https://doc.dovecot.org/admin_manual/
list_of_events/#authentication-server for details.
imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated and
imap_client_unhibernate_retried events. See https://doc.dovecot.org/
admin_manual/list_of_events/ for details.
lib-index: Added new mail_index_recreated event. See https://doc.dovecot.org/
admin_manual/list_of_events/#mail-index-recreated
lib-sql: Support TLS options for cassandra driver. This requires cpp-driver
v2.15 (or later) to work reliably.
lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now added to
existing mails if mail_attachment_detection_option=add-flags and it can be done
inexpensively.
login proxy: Added login_proxy_max_reconnects setting (default 3) to control
how many reconnections are attempted.
login proxy: imap/pop3/submission/managesieve proxying now supports
reconnection retrying on more than just connect() failure. Any error except a
non-temporary authentication failure will result in reconnect attempts.
auth: Lua passdb/userdb leaks stack elements per call, eventually causing the
stack to become too deep and crashing the auth or auth-worker process.
auth: SASL authentication PLAIN mechanism could be used to trigger read buffer
overflow. However, this doesn't seem to be exploitable in any way.
auth: v2.3.11 regression: GSSAPI authentication fails because dovecot disallows
NUL bytes for it.
dict: Process used too much CPU when iterating keys, because each key used a
separate write() syscall.
doveadm-server: Crash could occur if logging was done outside command handling.
For example http-client could have done debug logging afterwards, resulting in
either segfault or Panic: file http-client.c:
line 642 (http_client_context_close): assertion failed:
(cctx->clients_list == NULL).
doveadm-server: v2.3.11 regression: Trying to connect to doveadm server process
via starttls assert-crashed if there were no ssl=yes listeners:
Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
assertion failed: (service->ssl_ctx_initialized).
fts-solr: HTTP requests may have assert-crashed: Panic: file
http-client-request.c: line 1232 (http_client_request_send_more):
assertion failed: (req->payload_input != NULL)
imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
configuration that causes errors. Sending the error responses to the client can
cause the segmentation fault. This can for example happen when several
namespaces use the same mail storage location.
imap: IMAP NOTIFY used on a shared namespace that doesn't actually exist (e.g.
public namespace for a nonexistent user) can crash with a panic:
Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index:
Opened in (null):0
imap: IMAP session can crash with QRESYNC extension if many changes are done
before asking for expunged mails since last sync.
imap: Process might hang indefinitely if client disconnects after sending some
long-running commands pipelined, for example FETCH+LOGOUT.
lib-compress: Mitigate crashes when configuring a not compiled in compression.
Errors with compression configuration now distinguish between not supported and
unknown.
lib-compression: Using xz/lzma compression in v2.3.11 could have written
truncated output in some situations. This would result in "Broken pipe" read
errors when trying to read it back.
lib-compression: zstd compression could have crashed in some situations: Panic:
file ostream.c: line 287 (o_stream_sendv_int): assertion failed:
(!stream->blocking)
lib-dict: dict client could have crashed in some rare situations when iterating
keys.
lib-http: Fix several assert-crashes in HTTP client.
lib-index: v2.3.11 regression: When mails were expunged at the same time as
lots of new content was being saved to the cache (e.g. cache file was lost and
is being re-filled) a deadlock could occur with dovecot.index.cache /
dovecot.index.log.
lib-index: v2.3.11 regression: dovecot.index.cache file was being purged
(rewritten) too often when it had a field that hadn't been accessed for over 1
month, but less than 2 months. Every cache file change caused a purging in this
situation.
lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
Regression caused by fixing CVE-2020-12100.
lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE was
written in a way that may have caused confusion for both IMAP clients and
Dovecot itself when parsing it. The truncated part is now written out using
application/octet-stream MIME type.
lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the 10000th
MIME part was message/rfc822 (or if parent was multipart/digest): Panic: file
message-parser.c: line 167 (message_part_append): assertion failed: (ctx->
total_parts_count <= ctx->max_total_mime_parts).
lib-oauth2: Dovecot incorrectly required oauth2 server introspection reply to
contain username with invalid token.
lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has deprecated
APIs disabled.
lib-storage: When mail's size is different from the cached one (in
dovecot.index.cache or Maildir S=size in the filename), this is handled by
logging "Cached message size smaller/larger than expected" error. However, in
some situations this also ended up crashing with: Panic:
file istream.c: line 315 (i_stream_read_memarea): assertion failed:
(old_size <= _stream->pos - _stream->skip).
lib-storage: v2.3 regression: Copying/moving mails was taking much more memory
than before. This was mainly visible when copying/moving thousands of mails in
a single transaction.
lib-storage: v2.3.11 regression: Searching messages assert-crashed (without
FTS): Panic: file message-parser.c: line 174 (message_part_finish): assertion
failed: (ctx->nested_parts_count > 0).
lib: Dovecot v2.3 moved signal handlers around in ioloops, causing more CPU
usage than in v2.2.
lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted in error
if it happened to be at read boundary. Any NUL characters and '\u0000' will now
result in parsing error instead of silently truncating the data.
lmtp, submission: Server may hang if SSL client connection disconnects during
the delivery. If this happened repeated, it could have ended up reaching
process_limit and preventing any further lmtp/submission deliveries.
lmtp: Proxy does not always properly log TLS connection problems as errors; in
some cases, only a debug message is logged if enabled.
lmtp: The LMTP service can hang when commands are pipelined. This can
particularly occur when one command in the middle of the pipeline fails. One
example of this occurs for proxied LMTP transactions in which the final DATA or
BDAT command is pipelined after a failing RCPT command.
login-proxy: The login_source_ips setting has no effect, and therefore the
proxy source IPs are not cycled through as they should be.
master: Process was using 100% CPU in some situations when a broken service was
being throttled.
pop3-login: POP3 login would fail with "Input buffer full" if the initial
response for SASL was too long.
stats: Crash would occur when generating openmetrics data for metrics using
aggregating functions.
Update pigeonhole to version 0.5.15
o CVE-2020-28200: Sieve interpreter is not protected against abusive scripts
that claim excessive resource usage. Fixed by limiting the user CPU time
per single script execution and cumulatively over several script runs
within a configurable timeout period. Sufficiently large CPU time usage is
summed in the Sieve script binary and execution is blocked when the sum
exceeds the limit within that time. The block is lifted when the script is
updated after the resource usage times out. (bsc#1187420) Attacker can DoS
the mail delivery system (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
o Disconnection log messages are now more standardized across services. They
also always now start with "Disconnected" prefix.
o managesieve: Commands pipelined together with and just after the
authenticate command cause these commands to be executed twice.
o duplicate: The test was handled badly in a multiscript (sieve_before,
sieve_after) scenario in which an earlier script in the sequence with a
duplicate test succeeded, while a later script caused a runtime failure. In
that case, the message is recorded for duplicate tracking, while the
message may not actually have been delivered in the end.
o editheader: Sieve interpreter entered infinite loop at startup when the
"editheader" configuration listed an invalid header name. This problem can
only be triggered by the administrator.
o relational: The Sieve relational extension can cause a segfault at compile
time. This is triggered by invalid script syntax. The segfault happens when
this match type is the last argument of the test command. This situation is
not possible in a valid script; positional arguments are normally present
after that, which would prevent the segfault.
o sieve: For some Sieve commands the provided mailbox name is not properly
checked for UTF-8 validity, which can cause assert crashes at runtime when
an invalid mailbox name is encountered. This can be caused by the user by
writing a bad Sieve script involving the affected commands
("mailboxexists", "specialuse_exists"). This can be triggered by the remote
sender only when the user has written a Sieve script that passes message
content to one of the affected commands.
o sieve: Large sequences of 8-bit octets passed to certain Sieve commands
that create or modify message headers that allow UTF-8 text (vacation,
notify and addheader) can cause the delivery or IMAP process (when
IMAPSieve is used) to enter a memory-consuming semi-infinite loop that ends
when the process exceeds its memory limits. Logged in users can cause these
hangs only for their own processes.
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE Manager Server 4.0:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.0-2021-2891=1
o SUSE Manager Retail Branch Server 4.0:
zypper in -t patch
SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.0-2021-2891=1
o SUSE Manager Proxy 4.0:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.0-2021-2891=1
o SUSE Linux Enterprise Server for SAP 15-SP1:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2021-2891=1
o SUSE Linux Enterprise Server 15-SP1-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2021-2891=1
o SUSE Linux Enterprise Server 15-SP1-BCL:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2021-2891=1
o SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2021-2891=1
o SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2021-2891=1
o SUSE Enterprise Storage 6:
zypper in -t patch SUSE-Storage-6-2021-2891=1
o SUSE CaaS Platform 4.0:
To install this update, use the SUSE CaaS Platform 'skuba' tool. I will
inform you if it detects new updates and let you then trigger updating of
the complete cluster in a controlled way.
Package List:
o SUSE Manager Server 4.0 (ppc64le s390x x86_64):
dovecot23-2.3.15-27.3
dovecot23-backend-mysql-2.3.15-27.3
dovecot23-backend-mysql-debuginfo-2.3.15-27.3
dovecot23-backend-pgsql-2.3.15-27.3
dovecot23-backend-pgsql-debuginfo-2.3.15-27.3
dovecot23-backend-sqlite-2.3.15-27.3
dovecot23-backend-sqlite-debuginfo-2.3.15-27.3
dovecot23-debuginfo-2.3.15-27.3
dovecot23-debugsource-2.3.15-27.3
dovecot23-devel-2.3.15-27.3
dovecot23-fts-2.3.15-27.3
dovecot23-fts-debuginfo-2.3.15-27.3
dovecot23-fts-lucene-2.3.15-27.3
dovecot23-fts-lucene-debuginfo-2.3.15-27.3
dovecot23-fts-solr-2.3.15-27.3
dovecot23-fts-solr-debuginfo-2.3.15-27.3
dovecot23-fts-squat-2.3.15-27.3
dovecot23-fts-squat-debuginfo-2.3.15-27.3
o SUSE Manager Retail Branch Server 4.0 (x86_64):
dovecot23-2.3.15-27.3
dovecot23-backend-mysql-2.3.15-27.3
dovecot23-backend-mysql-debuginfo-2.3.15-27.3
dovecot23-backend-pgsql-2.3.15-27.3
dovecot23-backend-pgsql-debuginfo-2.3.15-27.3
dovecot23-backend-sqlite-2.3.15-27.3
dovecot23-backend-sqlite-debuginfo-2.3.15-27.3
dovecot23-debuginfo-2.3.15-27.3
dovecot23-debugsource-2.3.15-27.3
dovecot23-devel-2.3.15-27.3
dovecot23-fts-2.3.15-27.3
dovecot23-fts-debuginfo-2.3.15-27.3
dovecot23-fts-lucene-2.3.15-27.3
dovecot23-fts-lucene-debuginfo-2.3.15-27.3
dovecot23-fts-solr-2.3.15-27.3
dovecot23-fts-solr-debuginfo-2.3.15-27.3
dovecot23-fts-squat-2.3.15-27.3
dovecot23-fts-squat-debuginfo-2.3.15-27.3
o SUSE Manager Proxy 4.0 (x86_64):
dovecot23-2.3.15-27.3
dovecot23-backend-mysql-2.3.15-27.3
dovecot23-backend-mysql-debuginfo-2.3.15-27.3
dovecot23-backend-pgsql-2.3.15-27.3
dovecot23-backend-pgsql-debuginfo-2.3.15-27.3
dovecot23-backend-sqlite-2.3.15-27.3
dovecot23-backend-sqlite-debuginfo-2.3.15-27.3
dovecot23-debuginfo-2.3.15-27.3
dovecot23-debugsource-2.3.15-27.3
dovecot23-devel-2.3.15-27.3
dovecot23-fts-2.3.15-27.3
dovecot23-fts-debuginfo-2.3.15-27.3
dovecot23-fts-lucene-2.3.15-27.3
dovecot23-fts-lucene-debuginfo-2.3.15-27.3
dovecot23-fts-solr-2.3.15-27.3
dovecot23-fts-solr-debuginfo-2.3.15-27.3
dovecot23-fts-squat-2.3.15-27.3
dovecot23-fts-squat-debuginfo-2.3.15-27.3
o SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64):
dovecot23-2.3.15-27.3
dovecot23-backend-mysql-2.3.15-27.3
dovecot23-backend-mysql-debuginfo-2.3.15-27.3
dovecot23-backend-pgsql-2.3.15-27.3
dovecot23-backend-pgsql-debuginfo-2.3.15-27.3
dovecot23-backend-sqlite-2.3.15-27.3
dovecot23-backend-sqlite-debuginfo-2.3.15-27.3
dovecot23-debuginfo-2.3.15-27.3
dovecot23-debugsource-2.3.15-27.3
dovecot23-devel-2.3.15-27.3
dovecot23-fts-2.3.15-27.3
dovecot23-fts-debuginfo-2.3.15-27.3
dovecot23-fts-lucene-2.3.15-27.3
dovecot23-fts-lucene-debuginfo-2.3.15-27.3
dovecot23-fts-solr-2.3.15-27.3
dovecot23-fts-solr-debuginfo-2.3.15-27.3
dovecot23-fts-squat-2.3.15-27.3
dovecot23-fts-squat-debuginfo-2.3.15-27.3
o SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64):
dovecot23-2.3.15-27.3
dovecot23-backend-mysql-2.3.15-27.3
dovecot23-backend-mysql-debuginfo-2.3.15-27.3
dovecot23-backend-pgsql-2.3.15-27.3
dovecot23-backend-pgsql-debuginfo-2.3.15-27.3
dovecot23-backend-sqlite-2.3.15-27.3
dovecot23-backend-sqlite-debuginfo-2.3.15-27.3
dovecot23-debuginfo-2.3.15-27.3
dovecot23-debugsource-2.3.15-27.3
dovecot23-devel-2.3.15-27.3
dovecot23-fts-2.3.15-27.3
dovecot23-fts-debuginfo-2.3.15-27.3
dovecot23-fts-lucene-2.3.15-27.3
dovecot23-fts-lucene-debuginfo-2.3.15-27.3
dovecot23-fts-solr-2.3.15-27.3
dovecot23-fts-solr-debuginfo-2.3.15-27.3
dovecot23-fts-squat-2.3.15-27.3
dovecot23-fts-squat-debuginfo-2.3.15-27.3
o SUSE Linux Enterprise Server 15-SP1-BCL (x86_64):
dovecot23-2.3.15-27.3
dovecot23-backend-mysql-2.3.15-27.3
dovecot23-backend-mysql-debuginfo-2.3.15-27.3
dovecot23-backend-pgsql-2.3.15-27.3
dovecot23-backend-pgsql-debuginfo-2.3.15-27.3
dovecot23-backend-sqlite-2.3.15-27.3
dovecot23-backend-sqlite-debuginfo-2.3.15-27.3
dovecot23-debuginfo-2.3.15-27.3
dovecot23-debugsource-2.3.15-27.3
dovecot23-devel-2.3.15-27.3
dovecot23-fts-2.3.15-27.3
dovecot23-fts-debuginfo-2.3.15-27.3
dovecot23-fts-lucene-2.3.15-27.3
dovecot23-fts-lucene-debuginfo-2.3.15-27.3
dovecot23-fts-solr-2.3.15-27.3
dovecot23-fts-solr-debuginfo-2.3.15-27.3
dovecot23-fts-squat-2.3.15-27.3
dovecot23-fts-squat-debuginfo-2.3.15-27.3
o SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64
x86_64):
dovecot23-2.3.15-27.3
dovecot23-backend-mysql-2.3.15-27.3
dovecot23-backend-mysql-debuginfo-2.3.15-27.3
dovecot23-backend-pgsql-2.3.15-27.3
dovecot23-backend-pgsql-debuginfo-2.3.15-27.3
dovecot23-backend-sqlite-2.3.15-27.3
dovecot23-backend-sqlite-debuginfo-2.3.15-27.3
dovecot23-debuginfo-2.3.15-27.3
dovecot23-debugsource-2.3.15-27.3
dovecot23-devel-2.3.15-27.3
dovecot23-fts-2.3.15-27.3
dovecot23-fts-debuginfo-2.3.15-27.3
dovecot23-fts-lucene-2.3.15-27.3
dovecot23-fts-lucene-debuginfo-2.3.15-27.3
dovecot23-fts-solr-2.3.15-27.3
dovecot23-fts-solr-debuginfo-2.3.15-27.3
dovecot23-fts-squat-2.3.15-27.3
dovecot23-fts-squat-debuginfo-2.3.15-27.3
o SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64
x86_64):
dovecot23-2.3.15-27.3
dovecot23-backend-mysql-2.3.15-27.3
dovecot23-backend-mysql-debuginfo-2.3.15-27.3
dovecot23-backend-pgsql-2.3.15-27.3
dovecot23-backend-pgsql-debuginfo-2.3.15-27.3
dovecot23-backend-sqlite-2.3.15-27.3
dovecot23-backend-sqlite-debuginfo-2.3.15-27.3
dovecot23-debuginfo-2.3.15-27.3
dovecot23-debugsource-2.3.15-27.3
dovecot23-devel-2.3.15-27.3
dovecot23-fts-2.3.15-27.3
dovecot23-fts-debuginfo-2.3.15-27.3
dovecot23-fts-lucene-2.3.15-27.3
dovecot23-fts-lucene-debuginfo-2.3.15-27.3
dovecot23-fts-solr-2.3.15-27.3
dovecot23-fts-solr-debuginfo-2.3.15-27.3
dovecot23-fts-squat-2.3.15-27.3
dovecot23-fts-squat-debuginfo-2.3.15-27.3
o SUSE Enterprise Storage 6 (aarch64 x86_64):
dovecot23-2.3.15-27.3
dovecot23-backend-mysql-2.3.15-27.3
dovecot23-backend-mysql-debuginfo-2.3.15-27.3
dovecot23-backend-pgsql-2.3.15-27.3
dovecot23-backend-pgsql-debuginfo-2.3.15-27.3
dovecot23-backend-sqlite-2.3.15-27.3
dovecot23-backend-sqlite-debuginfo-2.3.15-27.3
dovecot23-debuginfo-2.3.15-27.3
dovecot23-debugsource-2.3.15-27.3
dovecot23-devel-2.3.15-27.3
dovecot23-fts-2.3.15-27.3
dovecot23-fts-debuginfo-2.3.15-27.3
dovecot23-fts-lucene-2.3.15-27.3
dovecot23-fts-lucene-debuginfo-2.3.15-27.3
dovecot23-fts-solr-2.3.15-27.3
dovecot23-fts-solr-debuginfo-2.3.15-27.3
dovecot23-fts-squat-2.3.15-27.3
dovecot23-fts-squat-debuginfo-2.3.15-27.3
o SUSE CaaS Platform 4.0 (x86_64):
dovecot23-2.3.15-27.3
dovecot23-backend-mysql-2.3.15-27.3
dovecot23-backend-mysql-debuginfo-2.3.15-27.3
dovecot23-backend-pgsql-2.3.15-27.3
dovecot23-backend-pgsql-debuginfo-2.3.15-27.3
dovecot23-backend-sqlite-2.3.15-27.3
dovecot23-backend-sqlite-debuginfo-2.3.15-27.3
dovecot23-debuginfo-2.3.15-27.3
dovecot23-debugsource-2.3.15-27.3
dovecot23-devel-2.3.15-27.3
dovecot23-fts-2.3.15-27.3
dovecot23-fts-debuginfo-2.3.15-27.3
dovecot23-fts-lucene-2.3.15-27.3
dovecot23-fts-lucene-debuginfo-2.3.15-27.3
dovecot23-fts-solr-2.3.15-27.3
dovecot23-fts-solr-debuginfo-2.3.15-27.3
dovecot23-fts-squat-2.3.15-27.3
dovecot23-fts-squat-debuginfo-2.3.15-27.3
References:
o https://www.suse.com/security/cve/CVE-2020-28200.html
o https://www.suse.com/security/cve/CVE-2021-29157.html
o https://bugzilla.suse.com/1187418
o https://bugzilla.suse.com/1187419
o https://bugzilla.suse.com/1187420
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYTAMfuNLKJtyKPYoAQgXeQ/+JuNW1wzMxke39zK4HlvwASYFgDfus4bw
R2cp38DNXkuMknuW8KahlQYnX4fCV/JzxzGL2NZ2ioKTxS0Gpe1jQ2VSI8QAaHCI
9WeG5DvxoDuzsm3zI9WKw7oKe+AOcKscI6wd4H6F1dflN+Kbl0RX5CmrYQ+BZPqx
qL+rqH4i7RPve16wJv8uk6MChvLorqPR7yMVk1ft+lJxzv/jf1Gc4J7QLs/GUqKQ
IRA87vu/vRVCGzF0zSJ0zlcjEBerapVOe3YqN59ye45l8fyq9pilkbJt7ZhE2eH8
FMn4aklOzqwbrdB2u8f4knVkIWjfP3hjDaqszPMqcYWFsJwAgO8tzBxyNaPXAhEz
gVedxGZqe3PrhTOscCV3iQaB23G0yccqjNiYgE2o8vLz6OVR9GOG/BXCatoFsP1i
FcSz23YKpdRAobHjEIsp6ve/AZhQYa1ATgP5e4d5O4W4p6beQrnPg/qOrRZtzlwl
UY/8gFvrZygWULHl/RvDliYD9yWjkbP38bPM+7x9cSonq4z2Y5WUP/4Isg5SQWYy
yhpc70p/SzylaoTvF1CBbRkxd0K+L5knDZT6AkUmQ7jlqIN8nWawCelLc2uhcXf+
zQKxRrU6qdCHm1/HmUbo5Iezl6aE2IfbUsNA4kYWYzcXDyqDKSsqqVCa0lSxZESC
c6dVl7f7hY8=
=XD4n
-----END PGP SIGNATURE-----