Package: dovecot-core Version: 1:2.4.5+dfsg1-2 Severity: important Tags: security X-Debbugs-Cc: Debian Security Team <[email protected]>
Dear Maintainer,
AFAICT the upstream fix for CVE-2026-40017 [0] relies on a new keyed
xxh64 strmap format v2, but the v1 → v2 on-disk upgrade only happens
when `dovecot_storage_version` is set to 2.4.5 or later:
https://github.com/dovecot/core/commit/d34ac20f89bef60f91cd898e431018ee57061125#diff-961059ca1c2993805f95ac5427aefdfea627c13a2c3476855fd859888a522cf0
However /etc/dovecot/dovecot.conf from 1:2.4.5+dfsg1-2 contains the
following two lines
dovecot_config_version = 2.4.0
dovecot_storage_version = 2.4.0
so AFAICT existing installations keep using crc32 hashes and remain
affected by the denial of service issue. X-Debbugs-Cc'ing secteam as
heads up: for the backports to older suites it might make sense to lower
the version threshold. (Given 2.3 series lack the storage version check
logic I will unconditionally trigger the v1 → v2 on-disk upgrade for
Bookworm LTS, but need to wait for subsequent suites to add support for
the v2 format to avoid broken upgrade paths.)
Unfortunately dovecot doesn't allow overriding `dovecot_*_version` later
in `/etc/dovecot/conf.d/99-*.conf`. Please consider bumping *both*
`dovecot_config_version` and `dovecot_storage_version` to 2.4.5.
An argument for bumping the former too is to honor the current
`mail_attachment_detection_options` default value for maildir. With the
current value dovecot adds `$HasAttachment` or `$HasNoAttachment
keywords for maildir too, but doesn't bump the HIGHESTMODSEQ counter
resulting in split-brain issues for QRESYNC-capable synchronization
tools (possibly a dovecot bug, but the stock configuration is not
affected and given `dovecot_storage_version` needs to be bumped anyway
it probably makes sense to upgrade `dovecot_config_version` too).
Thanks for maintaining dovecot!
--
Guilhem.
[0] IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html#cve-2026-40017-imap-thread-o-m3-cpu-dos-via-crc32-hash-collision-in-strmap-mail-index-strmap-c-hash2-c
[1]
https://doc.dovecot.org/2.4.5/core/summaries/settings.html#mail_attachment_detection_options
signature.asc
Description: PGP signature
