Re: Dovecot v2.3.13 released
Hello Aki, fts-solr is still crashing here. We have many X- headers from antispam, DKIM, and so on, I don't know if it has anything to do with it. The same configuration worked a couple of versions ago. Regards, Diego. Latest debian 10.7, binaries from repo.dovecot.org/ce-2.3-latest/debian/buster # dovecot --version 2.3.13 (89f716dc2) # for i in diego.liziero; do doveadm index -u $i \*; echo indexed $i; done doveadm(diego.liziero): Panic: file http-client-request.c: line 1240 (http_client_request_send_more): assertion failed: (req->payload_input != NULL) doveadm(diego.liziero): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x3d) [0x7f9108b8561d] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f9108b8573e] -> /usr/lib/dovecot/libdovecot.so.0(+0xfa79b) [0x7f9108b9179b] -> /usr/lib/dovecot/libdovecot.so.0(+0xfa7d1) [0x7f9108b917d1] -> /usr/lib/dovecot/libdovecot.so.0(+0x52e30) [0x7f9108ae9e30] -> /usr/lib/dovecot/libdovecot.so.0(+0x4a868) [0x7f9108ae1868] -> /usr/lib/dovecot/libdovecot.so.0(http_client_connection_output+0xf2) [0x7f9108b36cc2] -> /usr/lib/dovecot/libdovecot.so.0(+0x120481) [0x7f9108bb7481] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f9108ba7599] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x131) [0x7f9108ba8b11] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x4c) [0x7f9108ba763c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f9108ba77b0] -> /usr/lib/dovecot/libdovecot.so.0(+0x9b610) [0x7f9108b32610] -> /usr/lib/dovecot/libdovecot.so.0(http_client_request_send_payload+0x30) [0x7f9108b326e0] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0xf15d) [0x7f910831415d] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(fts_parser_more+0x27) [0x7f9108312f87] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0xc25f) [0x7f910831125f] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(fts_build_mail+0x4d) [0x7f910831198d] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0x12060) [0x7f9108317060] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_precache+0x2e) [0x7f9108ca5a0e] -> doveadm(+0x368ff) [0x56138f8c98ff] -> doveadm(+0x30ee6) [0x56138f8c3ee6] -> doveadm(+0x31ada) [0x56138f8c4ada] -> doveadm(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x21a) [0x56138f8c587a] -> doveadm(doveadm_cmd_run_ver2+0x4df) [0x56138f8d5d2f] -> doveadm(doveadm_cmd_try_run_ver2+0x37) [0x56138f8d5d87] -> doveadm(main+0x1ca) [0x56138f8b4e9a] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7f910871e09b] -> doveadm(_start+0x2a) [0x56138f8b537a] Aborted On Mon, Jan 4, 2021 at 1:04 PM Aki Tuomi wrote: > [..] > - fts-solr: HTTP requests may have assert-crashed: > Panic: file http-client-request.c: line 1232 > (http_client_request_send_more): > assertion failed: (req->payload_input != NULL) > >
Re: Dovecot v2.3.13 released
> On 06/01/2021 15:37 Juri Haberland wrote: > > > On 04/01/2021 13:02, Aki Tuomi wrote: > > We are pleased to release v2.3.13. Please find it from locations below: > > > > https://dovecot.org/releases/2.3/dovecot-2.3.13.tar.gz > > https://dovecot.org/releases/2.3/dovecot-2.3.13.tar.gz.sig > > Binary packages in https://repo.dovecot.org/ > > Docker images in https://hub.docker.com/r/dovecot/dovecot > > While trying to rebuild packages for Ubuntu Bionic (18.04) for i386 I > noticed that the size and checksum for > dovecot_2.3.13-2+ubuntu18.04.debian.tar.xz was wrong as reported in the > dovecot-Ubuntu_18.04.dsc file as well as the checksum for > dovecot-pigeonhole_2.3.13-2+ubuntu18.04.debian.tar.xz as reported in the > dovecot-pigeonhole-Ubuntu_18.04.dsc file, so I had to manually change > the *.dsc files. > > I had the same problem with the last release 2.3.11.3 so it seems there > is something wrong in your release process of Ubuntu packages. > > > Cheers, > Juri Thanks, we'll take a look. Aki
Re: Dovecot v2.3.13 released
On 04/01/2021 13:02, Aki Tuomi wrote: > We are pleased to release v2.3.13. Please find it from locations below: > > https://dovecot.org/releases/2.3/dovecot-2.3.13.tar.gz > https://dovecot.org/releases/2.3/dovecot-2.3.13.tar.gz.sig > Binary packages in https://repo.dovecot.org/ > Docker images in https://hub.docker.com/r/dovecot/dovecot While trying to rebuild packages for Ubuntu Bionic (18.04) for i386 I noticed that the size and checksum for dovecot_2.3.13-2+ubuntu18.04.debian.tar.xz was wrong as reported in the dovecot-Ubuntu_18.04.dsc file as well as the checksum for dovecot-pigeonhole_2.3.13-2+ubuntu18.04.debian.tar.xz as reported in the dovecot-pigeonhole-Ubuntu_18.04.dsc file, so I had to manually change the *.dsc files. I had the same problem with the last release 2.3.11.3 so it seems there is something wrong in your release process of Ubuntu packages. Cheers, Juri
AW: Dovecot v2.3.13 released
Hey there, do you know anything new here, whether the update is also build for 16.04? Yours sincerely Pascal Rudolf -Ursprüngliche Nachricht- Von: dovecot Im Auftrag von Juri Haberland Gesendet: Mittwoch, 6. Januar 2021 00:13 An: dovecot@dovecot.org Betreff: Re: Dovecot v2.3.13 released On 04/01/2021 13:02, Aki Tuomi wrote: > We are pleased to release v2.3.13. Please find it from locations below: > Binary packages in https://repo.dovecot.org/ Hi Aki, is it on purpose that there is no build for Ubuntu Xenial 16.04 or is it just an oversight? Kind regards, Juri
Re: Dovecot v2.3.13 released
On 04/01/2021 13:02, Aki Tuomi wrote: > We are pleased to release v2.3.13. Please find it from locations below: > Binary packages in https://repo.dovecot.org/ Hi Aki, is it on purpose that there is no build for Ubuntu Xenial 16.04 or is it just an oversight? Kind regards, Juri
Re: Dovecot v2.3.13 released
On 04. 01. 21 13:02, Aki Tuomi wrote:
We are pleased to release v2.3.13. Please find it from locations below:
https://dovecot.org/releases/2.3/dovecot-2.3.13.tar.gz
https://dovecot.org/releases/2.3/dovecot-2.3.13.tar.gz.sig
Binary packages in https://repo.dovecot.org/
Docker images in https://hub.docker.com/r/dovecot/dovecot
Hi,
for i686 and armv7hl build time test fails on
Panic: file time-util.c: line 65 (timeval_cmp_margin): assertion failed:
(usecs_diff >= 0)
On these architectures, time_t in timeval->tv_sec is only 4 bytes, same
as (long) int.
This causes test to fail in
test_timeval_cmp_margin for test data
...
},{
.tv1 = { -INT_MAX, 0 },
.tv2 = { INT_MAX, 0 },
.output = -1,
},
...
as timeval_cmp_margin(...) tries to substract negative value from
maximal value and it overflows
48: usecs_diff = (tv2->tv_sec - tv1->tv_sec) * 100LL +
49: (tv2->tv_usec - tv1->tv_usec);
Cheers,
Michal
Dovecot v2.3.13 released
We are pleased to release v2.3.13. Please find it from locations below:
https://dovecot.org/releases/2.3/dovecot-2.3.13.tar.gz
https://dovecot.org/releases/2.3/dovecot-2.3.13.tar.gz.sig
Binary packages in https://repo.dovecot.org/
Docker images in https://hub.docker.com/r/dovecot/dovecot
Aki Tuomi
Open-Xchange oy
---
* CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
allow logged in user to access other people's emails and filesystem
information.
* Metric filter and global event filter variable syntax changed to a
SQL-like format. See
https://doc.dovecot.org/configuration_manual/event_filter/
* auth: Added new aliases for %{variables}. Usage of the old ones is
possible, but discouraged.
* auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
mechanism and related password schemes.
* auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
* auth: Removed postfix postmap socket
+ auth: Added new fields for auth server events. These fields are now
also available for all auth events. See
https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
for details.
+ imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
and imap_client_unhibernate_retried events. See
https://doc.dovecot.org/admin_manual/list_of_events/ for details.
+ lib-index: Added new mail_index_recreated event. See
https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
+ lib-sql: Support TLS options for cassandra driver. This requires
cpp-driver v2.15 (or later) to work reliably.
+ lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
added to existing mails if mail_attachment_detection_option=add-flags
and it can be done inexpensively.
+ login proxy: Added login_proxy_max_reconnects setting (default 3) to
control how many reconnections are attempted.
+ login proxy: imap/pop3/submission/managesieve proxying now supports
reconnection retrying on more than just connect() failure. Any error
except a non-temporary authentication failure will result in reconnect
attempts.
- auth: Lua passdb/userdb leaks stack elements per call, eventually
causing the stack to become too deep and crashing the auth or
auth-worker process.
- auth: SASL authentication PLAIN mechanism could be used to trigger
read buffer overflow. However, this doesn't seem to be exploitable in
any way.
- auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
disallows NUL bytes for it.
- dict: Process used too much CPU when iterating keys, because each key
used a separate write() syscall.
- doveadm-server: Crash could occur if logging was done outside command
handling. For example http-client could have done debug logging
afterwards, resulting in either segfault or
Panic: file http-client.c: line 642 (http_client_context_close):
assertion failed: (cctx->clients_list == NULL).
- doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
process via starttls assert-crashed if there were no ssl=yes listeners:
Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
assertion failed: (service->ssl_ctx_initialized).
- fts-solr: HTTP requests may have assert-crashed:
Panic: file http-client-request.c: line 1232
(http_client_request_send_more):
assertion failed: (req->payload_input != NULL)
- imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
configuration that causes errors. Sending the error responses to the
client can cause the segmentation fault. This can for example happen
when several namespaces use the same mail storage location.
- imap: IMAP NOTIFY used on a shared namespace that doesn't actually
exist (e.g. public namespace for a nonexistent user) can crash with a
panic:
Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index:
Opened in (null):0
- imap: IMAP session can crash with QRESYNC extension if many changes
are done before asking for expunged mails since last sync.
- imap: Process might hang indefinitely if client disconnects after
sending some long-running commands pipelined, for example FETCH+LOGOUT.
- lib-compress: Mitigate crashes when configuring a not compiled in
compression. Errors with compression configuration now distinguish
between not supported and unknown.
- lib-compression: Using xz/lzma compression in v2.3.11 could have
written truncated output in some situations. This would result in
"Broken pipe" read errors when trying to read it back.
- lib-compression: zstd compression could have crashed in some situations:
Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion
failed: (!stream->blocking)
- lib-dict: dict client could have crashed in some rare situations when
iterating keys.
- lib-http: Fix several assert-crashes in HTTP client.
- lib-index: v2.3.11 regression: When mails were expunged at the same
time as lots of new content was being saved to the cache (e.g. cache
file was lost
[Dovecot-news] Dovecot v2.3.13 released
We are pleased to release v2.3.13. Please find it from locations below:
https://dovecot.org/releases/2.3/dovecot-2.3.13.tar.gz
https://dovecot.org/releases/2.3/dovecot-2.3.13.tar.gz.sig
Binary packages in https://repo.dovecot.org/
Docker images in https://hub.docker.com/r/dovecot/dovecot
Aki Tuomi
Open-Xchange oy
---
* CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
allow logged in user to access other people's emails and filesystem
information.
* Metric filter and global event filter variable syntax changed to a
SQL-like format. See
https://doc.dovecot.org/configuration_manual/event_filter/
* auth: Added new aliases for %{variables}. Usage of the old ones is
possible, but discouraged.
* auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
mechanism and related password schemes.
* auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
* auth: Removed postfix postmap socket
+ auth: Added new fields for auth server events. These fields are now
also available for all auth events. See
https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
for details.
+ imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
and imap_client_unhibernate_retried events. See
https://doc.dovecot.org/admin_manual/list_of_events/ for details.
+ lib-index: Added new mail_index_recreated event. See
https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
+ lib-sql: Support TLS options for cassandra driver. This requires
cpp-driver v2.15 (or later) to work reliably.
+ lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
added to existing mails if mail_attachment_detection_option=add-flags
and it can be done inexpensively.
+ login proxy: Added login_proxy_max_reconnects setting (default 3) to
control how many reconnections are attempted.
+ login proxy: imap/pop3/submission/managesieve proxying now supports
reconnection retrying on more than just connect() failure. Any error
except a non-temporary authentication failure will result in reconnect
attempts.
- auth: Lua passdb/userdb leaks stack elements per call, eventually
causing the stack to become too deep and crashing the auth or
auth-worker process.
- auth: SASL authentication PLAIN mechanism could be used to trigger
read buffer overflow. However, this doesn't seem to be exploitable in
any way.
- auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
disallows NUL bytes for it.
- dict: Process used too much CPU when iterating keys, because each key
used a separate write() syscall.
- doveadm-server: Crash could occur if logging was done outside command
handling. For example http-client could have done debug logging
afterwards, resulting in either segfault or
Panic: file http-client.c: line 642 (http_client_context_close):
assertion failed: (cctx->clients_list == NULL).
- doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
process via starttls assert-crashed if there were no ssl=yes listeners:
Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
assertion failed: (service->ssl_ctx_initialized).
- fts-solr: HTTP requests may have assert-crashed:
Panic: file http-client-request.c: line 1232
(http_client_request_send_more):
assertion failed: (req->payload_input != NULL)
- imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
configuration that causes errors. Sending the error responses to the
client can cause the segmentation fault. This can for example happen
when several namespaces use the same mail storage location.
- imap: IMAP NOTIFY used on a shared namespace that doesn't actually
exist (e.g. public namespace for a nonexistent user) can crash with a
panic:
Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index:
Opened in (null):0
- imap: IMAP session can crash with QRESYNC extension if many changes
are done before asking for expunged mails since last sync.
- imap: Process might hang indefinitely if client disconnects after
sending some long-running commands pipelined, for example FETCH+LOGOUT.
- lib-compress: Mitigate crashes when configuring a not compiled in
compression. Errors with compression configuration now distinguish
between not supported and unknown.
- lib-compression: Using xz/lzma compression in v2.3.11 could have
written truncated output in some situations. This would result in
"Broken pipe" read errors when trying to read it back.
- lib-compression: zstd compression could have crashed in some situations:
Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion
failed: (!stream->blocking)
- lib-dict: dict client could have crashed in some rare situations when
iterating keys.
- lib-http: Fix several assert-crashes in HTTP client.
- lib-index: v2.3.11 regression: When mails were expunged at the same
time as lots of new content was being saved to the cache (e.g. cache
file was lost
