| Revision Date: | 2020-12-02 | Version: | 1 |
| Title: | Security update for dovecot23 (Moderate) |
| Description: |
This update for dovecot23 fixes the following issues:
dovecot was updated to 2.3.3 release, bringing lots of bugfixes (bsc#1124356).
Also the following security issue was fixed:
- CVE-2019-3814: A vulnerability in Dovecot related to SSL client certificate authentication was fixed (bsc#1123022)
The package changes:
Updated pigeonhole to 0.5.3:
- Fix assertion panic occurring when managesieve service fails to open INBOX while saving a Sieve script. This was caused by a lack of cleanup after failure. - Fix specific messages causing an assert panic with actions that compose a reply (e.g. vacation). With some rather weird input from the original message, the header folding algorithm (as used for composing the References header for the reply) got confused, causing the panic. - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command parsing. After finishing reading the Sieve script, the command parsing sometimes didn't continue with the search arguments. This is a time- critical bug that likely only occurs when the Sieve script is sent in the next TCP frame.
dovecot23 was updated to 2.3.3:
- doveconf hides more secrets now in the default output. - ssl_dh setting is no longer enforced at startup. If it's not set and non-ECC DH key exchange happens, error is logged and client is disconnected. - Added log_debug= setting. - Added log_core_filter= setting. - quota-clone: Write to dict asynchronously - --enable-hardening attempts to use retpoline Spectre 2 mitigations - lmtp proxy: Support source_ip passdb extra field. - doveadm stats dump: Support more fields and output stddev by default. - push-notification: Add SSL support for OX backend. - NUL bytes in mail headers can cause truncated replies when fetched. - director: Conflicting host up/down state changes may in some rare situations ended up in a loop of two directors constantly overwriting each others' changes. - director: Fix hang/crash when multiple doveadm commands are being handled concurrently. - director: Fix assert-crash if doveadm disconnects too early - virtual plugin: Some searches used 100% CPU for many seconds - dsync assert-crashed with acl plugin in some situations. (bsc#1119850) - mail_attachment_detection_options=add-flags-on-save assert-crashed with some specific Sieve scripts. - Mail snippet generation crashed with mails containing invalid Content-Type:multipart header. - Log prefix ordering was different for some log lines. - quota: With noenforcing option current quota usage wasn't updated. - auth: Kerberos authentication against Samba assert-crashed. - stats clients were unnecessarily chatty with the stats server. - imapc: Fixed various assert-crashes when reconnecting to server. - lmtp, submission: Fix potential crash if client disconnects while handling a command. - quota: Fixed compiling with glibc-2.26 / support libtirpc. - fts-solr: Empty search values resulted in 400 Bad Request errors - fts-solr: default_ns parameter couldn't be used - submission server crashed if relay server returned over 7 lines in a reply (e.g. to EHLO)
dovecot was updated to 2.3.2.1:
- SSL/TLS servers may have crashed during client disconnection - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have sometimes assert-crashed. - v2.3.2: 'make check' may have crashed with 32bit systems
dovecot was updated to 2.3.2:
- old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE while opening /proc/self/io. This may still cause security problems if the process is ptrace()d at the same time. Instead, open it while still running as root. - doveadm: Added mailbox cache decision&remove commands. See doveadm-mailbox(1) man page for details. - doveadm: Added rebuild attachments command for rebuilding $HasAttachment or $HasNoAttachment flags for matching mails. See doveadm-rebuild(1) man page for details. - cassandra: Use fallback_consistency on more types of errors - lmtp proxy: Support outgoing SSL/TLS connections - lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings. - submission: Add support for rawlog_dir - submission: Add submission_client_workarounds setting. - lua auth: Add password_verify() function and additional fields in auth request. - doveadm-server: TCP connections are hanging when there is a lot of network output. This especially caused hangs in dsync-replication. - Using multiple type=shared mdbox namespaces crashed - mail_fsync setting was ignored. It was always set to 'optimized'. - lua auth: Fix potential crash at deinit - SSL/TLS servers may have crashed if client disconnected during handshake. - SSL/TLS servers: Don't send extraneous certificates to client when alt certs are used. - lda, lmtp: Return-Path header without '<' may have assert-crashed. - lda, lmtp: Unencoded UTF-8 in email address headers may assert-crash - lda: -f parameter didn't allow empty/null/domainless address - lmtp, submission: Message size limit was hardcoded to 40 MB. Exceeding it caused the connection to get dropped during transfer. - lmtp: Fix potential crash when delivery fails at DATA stage - lmtp: login_greeting setting was ignored - Fix to work with OpenSSL v1.0.2f - systemd unit restrictions were too strict by default - Fix potential crashes when a lot of log output was produced - SMTP client may have assert-crashed when sending mail - IMAP COMPRESS: Send 'end of compression' marker when disconnecting. - cassandra: Fix consistency=quorum to work - dsync: Lock file generation failed if home directory didn't exist - Snippet generation for HTML mails didn't ignore &entities inside blockquotes, producing strange looking snippets. - imapc: Fix assert-crash if getting disconnected and after reconnection all mails in the selected mailbox are gone. - pop3c: Handle unexpected server disconnections without assert-crash - fts: Fixes to indexing mails via virtual mailboxes. - fts: If mails contained NUL characters, the text around it wasn't indexed. - Obsolete dovecot.index.cache offsets were sometimes used. Trying to fetch a field that was just added to cache file may not have always found it.
pigeonhole was updated to 0.5.2:
- Implement plugin for the a vendor-defined IMAP capability called 'FILTER=SIEVE'. It adds the ability to manually invoke Sieve filtering in IMAP. More information can be found in doc/plugins/imap_filter_sieve.txt. - The Sieve addess test caused an assertion panic for invalid addresses with UTF-8 codepoints in the localpart. Fixed by properly detecting invalid addresses with UTF-8 codepoints in the localpart and skipping these like other invalid addresses while iterating addresses for the address test. - Make the length of the subject header for the vacation response configurable and enforce the limit in UTF-8 codepoints rather than bytes. The subject header for a vacation response was statically truncated to 256 bytes, which is too limited for multi-byte UTF-8 characters. - Sieve editheader extension: Fix assertion panic occurring when it is used to manipulate a message header with a very large header field. - Properly abort execution of the sieve_discard script upon error. Before, the LDA Sieve plugin attempted to execute the sieve_discard script when an error occurs. This can lead to the message being lost. - Fix the interaction between quota and the sieve_discard script. When quota was used together with a sieve_discard script, the message delivery did not bounce when the quota was exceeded. - Fix crash for over quota users
|
| Family: | unix | Class: | patch |
| Status: | | Reference(s): | 1051510 1071995 1088047 1097975 1098633 1100352 1103200 1103206 1103990 1103991 1103992 1106383 1109837 1111666 1112374 1114685 1119113 1119532 1119850 1120423 1123022 1124356 1125703 1128902 1129715 1130836 1131645 1132390 1133401 1133738 1134303 1134395 1135556 1135642 1135897 1136161 1136264 1136343 1136935 1137526 1137625 1137728 1138879 1139712 1139751 1139771 1139865 1140133 1140228 1140328 1140405 1140424 1140428 1140454 1140463 1140575 1140577 1140637 1140658 1140715 1140719 1140726 1140727 1140728 1140814 1140887 1140888 1140889 1140891 1140893 1140948 1140954 1140955 1140956 1140957 1140958 1140959 1140960 1140961 1140962 1140964 1140971 1140972 1140992 1154064 1160968 1162972 1163985 1172356 1172402 1172698 1172704 1174415 1174543 1177409 1177412 1177413 1177414 CVE-2009-2666 CVE-2010-1167 CVE-2011-1947 CVE-2011-3389 CVE-2012-3482 CVE-2012-4453 CVE-2014-2524 CVE-2014-6271 CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 CVE-2018-13301 CVE-2018-20836 CVE-2018-5804 CVE-2018-5813 CVE-2018-5815 CVE-2018-5816 CVE-2019-10126 CVE-2019-10638 CVE-2019-10639 CVE-2019-11599 CVE-2019-12730 CVE-2019-13233 CVE-2019-17542 CVE-2019-3814 CVE-2019-4732 CVE-2019-9718 CVE-2020-12398 CVE-2020-12405 CVE-2020-12406 CVE-2020-12410 CVE-2020-15900 CVE-2020-1720 CVE-2020-2583 CVE-2020-2590 CVE-2020-2593 CVE-2020-2601 CVE-2020-2604 CVE-2020-2654 CVE-2020-2659 CVE-2020-27670 CVE-2020-27671 CVE-2020-27672 CVE-2020-27673 CVE-2020-8023 SUSE-SU-2019:0005-1 SUSE-SU-2019:0414-1 SUSE-SU-2019:1854-1 SUSE-SU-2019:3184-1 SUSE-SU-2020:0231-1 SUSE-SU-2020:0466-1 SUSE-SU-2020:0589-1 SUSE-SU-2020:1591-2 SUSE-SU-2020:1856-1 SUSE-SU-2020:2095-1 SUSE-SU-2020:2159-1 SUSE-SU-2020:3052-1
|
| Platform(s): | SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Desktop 11 SP4 SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise High Availability 12 SUSE Linux Enterprise High Availability 12 SP1 SUSE Linux Enterprise High Availability 12 SP2 SUSE Linux Enterprise High Availability 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise Module for Legacy Software 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Module for Web Scripting 12 SUSE Linux Enterprise Point of Sale 12 SP2-CLIENT SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for VMWare 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Workstation Extension 15 SUSE Linux Enterprise Workstation Extension 15 SP1 SUSE Linux Enterprise Workstation Extension 15 SP2 SUSE OpenStack Cloud 5
| Product(s): | |
| Definition Synopsis |
| SUSE Linux Enterprise Desktop 11 SP2 is installed AND Package Information
curl-7.19.7-1.20.31.1 is installed
OR libcurl4-7.19.7-1.20.31.1 is installed
OR libcurl4-32bit-7.19.7-1.20.31.1 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Desktop 12 is installed
AND Package Information
bash-4.2-75 is installed
OR bash-doc-4.2-75 is installed
OR bash-lang-4.2-75 is installed
OR libreadline6-6.2-75 is installed
OR libreadline6-32bit-6.2-75 is installed
OR readline-doc-6.2-75 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Desktop 12 SP1 is installed
AND Package Information
accountsservice-0.6.35-3 is installed
OR accountsservice-lang-0.6.35-3 is installed
OR libaccountsservice0-0.6.35-3 is installed
OR typelib-1_0-AccountsService-1_0-0.6.35-3 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Desktop 12 SP2 is installed
AND busybox-1.21.1-3 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Desktop 12 SP3 is installed
AND Package Information
gnome-keyring-3.20.0-27 is installed
OR gnome-keyring-32bit-3.20.0-27 is installed
OR gnome-keyring-lang-3.20.0-27 is installed
OR gnome-keyring-pam-3.20.0-27 is installed
OR gnome-keyring-pam-32bit-3.20.0-27 is installed
OR libgck-modules-gnome-keyring-3.20.0-27 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Desktop 12 SP4 is installed
AND Package Information
DirectFB-1.7.1-6 is installed
OR lib++dfb-1_7-1-1.7.1-6 is installed
OR libdirectfb-1_7-1-1.7.1-6 is installed
OR libdirectfb-1_7-1-32bit-1.7.1-6 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise High Availability 12 is installed
AND python-PyYAML-3.10-15.1 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise High Availability 12 SP1 is installed
AND Package Information
libpacemaker3-1.1.13-20.1 is installed
OR pacemaker-1.1.13-20.1 is installed
OR pacemaker-cli-1.1.13-20.1 is installed
OR pacemaker-cts-1.1.13-20.1 is installed
OR pacemaker-remote-1.1.13-20.1 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise High Availability 12 SP2 is installed
AND fence-agents-4.0.22+git.1455008135.15c5e92-8 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise High Availability 12 SP3 is installed
AND Package Information
cluster-md-kmp-default-4.4.73-5 is installed
OR dlm-kmp-default-4.4.73-5 is installed
OR gfs2-kmp-default-4.4.73-5 is installed
OR ocfs2-kmp-default-4.4.73-5 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise High Performance Computing 12 SP5 is installed
AND Package Information
PackageKit-1.1.3-24.9 is installed
OR PackageKit-backend-zypp-1.1.3-24.9 is installed
OR PackageKit-lang-1.1.3-24.9 is installed
OR libpackagekit-glib2-18-1.1.3-24.9 is installed
OR typelib-1_0-PackageKitGlib-1_0-1.1.3-24.9 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Live Patching 12 is installed
AND Package Information
kgraft-patch-3_12_51-52_34-default-1-2.1 is installed
OR kgraft-patch-3_12_51-52_34-xen-1-2.1 is installed
OR kgraft-patch-SLE12_Update_10-1-2.1 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Module for Server Applications 15 is installed
AND Package Information
dovecot23-2.3.3-4.7 is installed
OR dovecot23-backend-mysql-2.3.3-4.7 is installed
OR dovecot23-backend-pgsql-2.3.3-4.7 is installed
OR dovecot23-backend-sqlite-2.3.3-4.7 is installed
OR dovecot23-devel-2.3.3-4.7 is installed
OR dovecot23-fts-2.3.3-4.7 is installed
OR dovecot23-fts-lucene-2.3.3-4.7 is installed
OR dovecot23-fts-solr-2.3.3-4.7 is installed
OR dovecot23-fts-squat-2.3.3-4.7 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Point of Sale 12 SP2-CLIENT is installed
AND Package Information
libvirt-2.0.0-27.54 is installed
OR libvirt-client-2.0.0-27.54 is installed
OR libvirt-daemon-2.0.0-27.54 is installed
OR libvirt-daemon-config-network-2.0.0-27.54 is installed
OR libvirt-daemon-config-nwfilter-2.0.0-27.54 is installed
OR libvirt-daemon-driver-interface-2.0.0-27.54 is installed
OR libvirt-daemon-driver-libxl-2.0.0-27.54 is installed
OR libvirt-daemon-driver-lxc-2.0.0-27.54 is installed
OR libvirt-daemon-driver-network-2.0.0-27.54 is installed
OR libvirt-daemon-driver-nodedev-2.0.0-27.54 is installed
OR libvirt-daemon-driver-nwfilter-2.0.0-27.54 is installed
OR libvirt-daemon-driver-qemu-2.0.0-27.54 is installed
OR libvirt-daemon-driver-secret-2.0.0-27.54 is installed
OR libvirt-daemon-driver-storage-2.0.0-27.54 is installed
OR libvirt-daemon-hooks-2.0.0-27.54 is installed
OR libvirt-daemon-lxc-2.0.0-27.54 is installed
OR libvirt-daemon-qemu-2.0.0-27.54 is installed
OR libvirt-daemon-xen-2.0.0-27.54 is installed
OR libvirt-doc-2.0.0-27.54 is installed
OR libvirt-lock-sanlock-2.0.0-27.54 is installed
OR libvirt-nss-2.0.0-27.54 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Server 11 SP2 is installed
AND gd-2.0.36.RC1-52.18 is installed
|
| Definition Synopsis |
| Release Information
SUSE Linux Enterprise Server 11 SP3 is installed
AND dnsmasq-2.71-0.12.13.1 is installed
OR Package Information
SUSE Linux Enterprise Server for VMWare 11 SP3 is installed
AND dnsmasq-2.71-0.12.13.1 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Server 11 SP3 is installed
AND Package Information
PackageKit-0.3.14-2.28.46 is installed
OR PackageKit-lang-0.3.14-2.28.46 is installed
OR hal-0.5.12-23.68.1 is installed
OR hal-32bit-0.5.12-23.68.1 is installed
OR hal-doc-0.5.12-23.68.1 is installed
OR hal-x86-0.5.12-23.68.1 is installed
OR libpackagekit-glib10-0.3.14-2.28.46 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Server 12 is installed
AND Package Information
ImageMagick-6.8.8.1-8.2 is installed
OR libMagickCore-6_Q16-1-6.8.8.1-8.2 is installed
OR libMagickWand-6_Q16-1-6.8.8.1-8.2 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Server 12 SP1 is installed
AND Package Information
libsndfile1-1.0.25-21 is installed
OR libsndfile1-32bit-1.0.25-21 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Server 12 SP2 is installed
AND ant-1.9.4-1 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Server 12 SP3 is installed
AND Package Information
aaa_base-13.2+git20140911.61c1681-36 is installed
OR aaa_base-extras-13.2+git20140911.61c1681-36 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Server 12 SP4 is installed
AND Package Information
aaa_base-13.2+git20140911.61c1681-38.8 is installed
OR aaa_base-extras-13.2+git20140911.61c1681-38.8 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Server 12-LTSS is installed
AND Package Information
kgraft-patch-3_12_48-52_27-default-5-2.2 is installed
OR kgraft-patch-3_12_48-52_27-xen-5-2.2 is installed
OR kgraft-patch-SLE12_Update_8-5-2.2 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 is installed
AND Package Information
libX11-1.6.2-11 is installed
OR libX11-6-1.6.2-11 is installed
OR libX11-data-1.6.2-11 is installed
OR libX11-xcb1-1.6.2-11 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Server for SAP Applications 15 is installed
AND Package Information
libldap-2_4-2-2.4.46-9.31 is installed
OR libldap-2_4-2-32bit-2.4.46-9.31 is installed
OR libldap-data-2.4.46-9.31 is installed
OR openldap2-2.4.46-9.31 is installed
OR openldap2-back-meta-2.4.46-9.31 is installed
OR openldap2-back-perl-2.4.46-9.31 is installed
OR openldap2-client-2.4.46-9.31 is installed
OR openldap2-devel-2.4.46-9.31 is installed
OR openldap2-devel-32bit-2.4.46-9.31 is installed
OR openldap2-devel-static-2.4.46-9.31 is installed
OR openldap2-ppolicy-check-password-1.2-9.31 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Software Development Kit 11 SP3 is installed
AND Package Information
libQtWebKit-devel-4.6.3-5.34.2 is installed
OR libQtWebKit4-32bit-4.6.3-5.34.2 is installed
OR libQtWebKit4-x86-4.6.3-5.34.2 is installed
OR libqt4-devel-4.6.3-5.34.2 is installed
OR libqt4-devel-doc-4.6.3-5.34.2 is installed
OR libqt4-devel-doc-data-4.6.3-5.34.2 is installed
OR libqt4-sql-mysql-32bit-4.6.3-5.34.2 is installed
OR libqt4-sql-mysql-x86-4.6.3-5.34.2 is installed
OR libqt4-sql-postgresql-4.6.3-5.34.2 is installed
OR libqt4-sql-postgresql-32bit-4.6.3-5.34.2 is installed
OR libqt4-sql-postgresql-x86-4.6.3-5.34.2 is installed
OR libqt4-sql-sqlite-32bit-4.6.3-5.34.2 is installed
OR libqt4-sql-sqlite-x86-4.6.3-5.34.2 is installed
OR libqt4-sql-unixODBC-4.6.3-5.34.2 is installed
OR libqt4-sql-unixODBC-32bit-4.6.3-5.34.2 is installed
OR libqt4-sql-unixODBC-x86-4.6.3-5.34.2 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Software Development Kit 11 SP4 is installed
AND Package Information
bind-9.9.6P1-0.15.1 is installed
OR bind-devel-9.9.6P1-0.15.1 is installed
OR bind-devel-32bit-9.9.6P1-0.15.1 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Software Development Kit 12 is installed
AND Package Information
libasm-devel-0.158-3 is installed
OR libdw-devel-0.158-3 is installed
OR libebl-devel-0.158-3 is installed
OR libelf-devel-0.158-3 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Software Development Kit 12 SP1 is installed
AND Package Information
FastCGI-2.4.0-167 is installed
OR perl-FastCGI-2.4.0-167 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Software Development Kit 12 SP2 is installed
AND Package Information
ant-1.9.4-1 is installed
OR ant-jmf-1.9.4-1 is installed
OR ant-scripts-1.9.4-1 is installed
OR ant-swing-1.9.4-1 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Workstation Extension 15 is installed
AND Package Information
libraw-0.18.9-3.5 is installed
OR libraw-devel-0.18.9-3.5 is installed
OR libraw16-0.18.9-3.5 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Workstation Extension 15 SP1 is installed
AND Package Information
kernel-default-4.12.14-197.10 is installed
OR kernel-default-extra-4.12.14-197.10 is installed
|
| Definition Synopsis |
| SUSE Linux Enterprise Workstation Extension 15 SP2 is installed
AND Package Information
MozillaThunderbird-68.9.0-3.85 is installed
OR MozillaThunderbird-translations-common-68.9.0-3.85 is installed
OR MozillaThunderbird-translations-other-68.9.0-3.85 is installed
|