On Mon, Jul 20, 2026 at 11:14:15AM +0200, Wouter Verhelst wrote: > > After installing version 1:2.4.1+dfsg1-6+deb13u6 on my server, authentication > starts failing like so: > > wouter@pc220518:~$ mbsync -a > IMAP command 'AUTHENTICATE GSSAPI YIIC+AYJKoZ[...BASE64 data > censored...]/z04t1yLI4jO7FJia0=' returned an error: [AUTHENTICATIONFAILED] > Authentication failed.
Interesting. When I run gsasl's autopkgtest suite, which includes a gssapi authentication test, against trixie's 1:2.4.1+dfsg1-6+deb13u6 packages, it is able to authenticate successfully. > The changelog of that version mentions: > > * [366ef61] CVE-2026-33603: login-common: Only accept base64 in sasl > > Which seems like it might be overly strict? The patch was cherry-picked from upstream and is in sid/forky as well as the current upstream releases. Which is not to say that it can't have introduced a regression, of course... > At any rate, downgrading to 1:2.4.1+dfsg1-6+deb13u5 resolves the issue. I'll continue investigating. I have not tested your configuration, nor have I tested mbsync, so there's more to look at. noah
