Public bug reported: A new release of dovecot is available for merging from Debian.
Ubuntu: 1:2.4.4+dfsg1-2ubuntu5 Debian Unstable: 1:2.4.5+dfsg1-4 ### New Debian Changes ### dovecot (1:2.4.5+dfsg1-4) unstable; urgency=medium * [ddf2660] autopkgtests: handle mariadbd socket in different locations -- Noah Meyerhans <[email protected]> Thu, 08 Oct 2026 15:57:37 -0400 dovecot (1:2.4.5+dfsg1-3) unstable; urgency=medium * [ae76ae5] update default dovecot_config_version and dovecot_storage_version (Closes: #1148937) * autopkgtests: fix mariadb socket path -- Noah Meyerhans <[email protected]> Sat, 26 Sep 2026 15:49:52 -0400 dovecot (1:2.4.5+dfsg1-2) unstable; urgency=medium * [8b432dd] lib: xxh64: fix byte ordering issue on big-endian systems (Closes: #1146449) * [45b5e14] Fix loong64 ftbfs (Closes: #1146490) -- Noah Meyerhans <[email protected]> Wed, 02 Sep 2026 12:17:57 -0400 dovecot (1:2.4.5+dfsg1-1) unstable; urgency=medium * [e470328] New upstream version 2.4.5+dfsg1 (Closes: #1146018) - https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html - CVE-2026-27852 - DoS by sending mail with bad header. - CVE-2026-33263 - submission-login: Panic when mail_max_userip_connections is reached - CVE-2026-33604 - SMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. - CVE-2026-33605 - managesieve-login: Pre-auth crash. - CVE-2026-33606 - dsync: Mail content can cause dsync protocol injection. - CVE-2026-33607 - Dovecot IMAP LIST match_sub() Exponential Backtracking - CPU Denial of Service. - CVE-2026-40013 - pigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. - CVE-2026-40014 - Whenever a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. - CVE-2026-40015 - An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. - CVE-2026-40017 - IMAP THREAD O(M³) CPU DoS via CRC32 Hash Collision in strmap - CVE-2026-40018 - MySQL multi-byte escaping wrong. - CVE-2026-40019 - v2.4.3 regression: managesieve-login pre-auth infinite loop. - CVE-2026-40203 - IMAP Compression Can Reveal Whether a Small Synced Email Body Matches Sender-Chosen Text. - CVE-2026-40204 - acl: lda_mailbox_autocreate can bypass acl restrictions. - CVE-2026-40205 - OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path - CVE-2026-42007 - Sieve editheader RCE. An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. - CVE-2026-42008 - XCLIENT FORWARD= bare token not namespaced, allows nopassword injection via trusted proxy. - CVE-2026-42391 - imap: Pre-login memory/CPU growth with ID command. - CVE-2026-42392 - imap-urlauth leaks memory into user-visible error messages. - CVE-2026-42393 - doveadm_password or api key length can still be leaked with timing comparisons. - CVE-2026-42395 - Single NUL-Byte XCLIENT FORWARD Payload Crashes. A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. - CVE-2026-52681 - Sieve resource usage tracking lost when active script changes. - CVE-2026-52687 - IMAP: COMPRESS ZSTD can cause excessive memory usage. - CVE-2026-73208 - auth: db-oauth2: aud claim used as fallback for missing scope claim. - CVE-2026-73209 - imap-login crash: Self-recursion on zero-output decompress chunks. * [0f045ed] refresh patches * [43cc0a0] d/copyright: reflect upstream's removal of src/lib-otp * [e781a92] update dovecot-mysql transitional package metadata -- Noah Meyerhans <[email protected]> Mon, 31 Aug 2026 15:19:46 -0400 ### Old Ubuntu Delta ### dovecot (1:2.4.4+dfsg1-2ubuntu5) stonking; urgency=medium * d/t/mariadb/00_setup: Fix mariadb autopkgtest setup (LP: #2168481). -- Lena Voytek <[email protected]> Fri, 02 Oct 2026 07:44:02 -0400 dovecot (1:2.4.4+dfsg1-2ubuntu4) stonking; urgency=medium * d/p/xxh64-endian-fix.patch: Fix byte ordering issue on big-endian system. LP: #2167733, Closes: #1146449 -- Finn Rayk Gartner <[email protected]> Mon, 21 Sep 2026 20:56:24 +0200 dovecot (1:2.4.4+dfsg1-2ubuntu3) stonking; urgency=medium * SECURITY UPDATE: OXDC-ADV-2026-0003 security updates - debian/patches/security-2026-03/*.patch: patches backported from upstream 2.4.5 branch. - CVE-2026-27852, CVE-2026-33263, CVE-2026-33604, CVE-2026-33605, CVE-2026-33606, CVE-2026-33607, CVE-2026-40013, CVE-2026-40014, CVE-2026-40015, CVE-2026-40017, CVE-2026-40018, CVE-2026-40019, CVE-2026-40203, CVE-2026-40204, CVE-2026-40205, CVE-2026-42007, CVE-2026-42008, CVE-2026-42391, CVE-2026-42392, CVE-2026-42393, CVE-2026-42395, CVE-2026-52681, CVE-2026-52687, CVE-2026-73208, CVE-2026-73209 -- Marc Deslauriers <[email protected]> Thu, 10 Sep 2026 11:44:04 -0400 dovecot (1:2.4.4+dfsg1-2ubuntu2) stonking; urgency=medium * Transition to lua5.5 (LP: #2155757) -- Mitchell Augustin <[email protected]> Fri, 21 Aug 2026 12:05:14 -0500 dovecot (1:2.4.4+dfsg1-2ubuntu1) stonking; urgency=medium * Merge with Debian unstable (LP: #2154098). Remaining changes: - d/rules: switch to -O2 (from -O3) on ppc64el to fix FTBFS (LP 2121250) * Dropped changes: - SECURITY UPDATE: safe filter issue when used with variable expansion + debian/patches/CVE-2026-27851.patch: lib-var-expand: Reset safe state when transfer is unset in src/lib-var-expand/test-var-expand.c, src/lib-var- expand/var-expand.c. + CVE-2026-27851 [Fixed upstream 2.4.4] - SECURITY UPDATE: fake SCRAM TLS channel binding via crafted base64 + debian/patches/CVE-2026-33603.patch: login-common: Only accept base64 in sasl in src/login-common/client-common-auth.c. + CVE-2026-33603 [Fixed upstream 2.4.4] - SECURITY UPDATE: CPU time limits bypass via sieve script + debian/patches/CVE-2026-40016.patch: lib-sieve: Enforce CPU time limit within :contains and :matches matcher loops in pigeonhole/src/lib- sieve/mcht-contains.c, pigeonhole/src/lib-sieve/mcht-matches.c, pigeonhole/src/lib-sieve/sieve-interpreter.c, pigeonhole/src/lib- sieve/sieve-interpreter.h. + CVE-2026-40016 [Fixed upstream 2.4.4] - SECURITY UPDATE: permission injection via IMAP SETACL command + debian/patches/CVE-2026-40020-pre1.patch: acl: Add acl_id_is_valid() in src/plugins/acl/acl-rights.c, src/plugins/acl/acl-rights.h. + debian/patches/CVE-2026-40020.patch: imap-acl: Fail if ACL identifier is invalid in src/plugins/imap-acl/imap-acl-plugin.c. + CVE-2026-40020 [Fixed upstream 2.4.4] - SECURITY UPDATE: memory consumption via excessive bracing over IMAP + debian/patches/CVE-2026-42006.patch: lib-imap: Fix imap_parser_params.list_count_limit to actually work in src/lib-imap/imap- parser.c, src/lib-imap/test-imap-parser.c. + CVE-2026-42006 [Fixed upstream 2.4.4] - SECURITY UPDATE: Improper input validation + debian/patches/CVE-2025-59028.patch: [PATCH 01/24] auth: Don't disconnect auth client when invalid base64 SASL input is received + CVE-2025-59028 [Fixed upstream 2.4.4] - SECURITY UPDATE: Exposure of Sensitive Information to an Unauthorized Actor + debian/patches/CVE-2025-59031.patch: [PATCH 02/24] fts: Remove decode2text.sh + debian/rules: Remove decode2text.sh from it. + debian/dovecot-core.examples: Remove decode2text.sh from it. + CVE-2025-59031 [Fixed upstream 2.4.4] - SECURITY UPDATE: Improper Input Validation + debian/patches/CVE-2025-59032.patch: managesieve-login: Fix crash when command didn't finish on the first call + CVE-2025-59032 [Fixed upstream 2.4.4] - SECURITY UPDATE: SQL/LDAP Injection + debian/patches/CVE-2026-24031-27860-1.patch: [PATCH 04/24] auth: Make struct settings_get_params params const + debian/patches/CVE-2026-24031-27860-2.patch: [PATCH 05/24] auth: passdb/userdb ldap - Fix escaping ldap filter, base and bind_userdn + debian/patches/CVE-2026-24031-27860-3.patch: [PATCH 06/24] lib- settings: settings_get_params() - Fix using provided escape_func + debian/patches/CVE-2026-24031-27860-4.patch: [PATCH 07/24] auth: test-auth - Run Lua unit tests even when building Lua as plugin + debian/patches/CVE-2026-24031-27860-5.patch: [PATCH 08/24] auth: Rewrite ldap_escape() with a unit test + debian/patches/CVE-2026-24031-27860-6.patch: [PATCH 09/24] auth: passdb sql - Fix escaping for set_credentials() + debian/patches/CVE-2026-24031-27860-7.patch: [PATCH 10/24] auth: userdb sql - Fix escaping for user iteration + debian/patches/CVE-2026-24031-27860-8.patch: [PATCH 11/24] lib- var-expand: Add "safe" filter to prevent escaping output + CVE-2026-24031 + CVE-2026-27860 [Fixed upstream 2.4.4] - SECURITY UPDATE: Authentication Bypass + debian/patches/CVE-2026-27855-1.patch: [PATCH 21/24] auth: cache - Use translated username in auth_cache_remove() + debian/patches/CVE-2026-27855-2.patch: [PATCH 22/24] auth: Move passdb event lifecycle handling to auth_request_passdb_event_(begin|end) + debian/patches/CVE-2026-27855-3.patch: [PATCH 23/24] auth: Initialize set_credentials event properly + debian/patches/CVE-2026-27855-4.patch: [PATCH 24/24] auth: passdb- sql - Require update_query to be set when used + CVE-2026-27855 [Fixed upstream 2.4.4] - SECURITY UPDATE: Improper Authentication + debian/patches/CVE-2026-27856-1.patch: [PATCH 16/24] doveadm: client-connection - Use timing safe credential check + debian/patches/CVE-2026-27856-2.patch: [PATCH 17/24] doveadm: Use datastack for temporary b64 value + debian/patches/CVE-2026-27856-3.patch: [PATCH 18/24] doveadm: client-connection - Get API key from per-connection settings + CVE-2026-27856 [Fixed upstream 2.4.4] - SECURITY UPDATE: Uncontrolled Resource Consumption + debian/patches/CVE-2026-27857-1.patch: [PATCH 1/2] plugins: imap- filter-sieve: imap-filter-sieve - Adjust to imap_parser_create() API change + debian/patches/CVE-2026-27857-2.patch: [PATCH 12/24] lib-imap, global: Add params parameter to imap_parser_create() + debian/patches/CVE-2026-27857-3.patch: [PATCH 13/24] lib-imap: Add imap_parser_params.list_count_limit + debian/patches/CVE-2026-27857-4.patch: [PATCH 14/24] imap-login: Limit the number of open IMAP parser lists + debian/patches/CVE-2026-27857-5.patch: [PATCH 15/24] global: Use const for struct imap_parser_params params + CVE-2026-27857 [Fixed upstream 2.4.4] - SECURITY UPDATE: Uncontrolled Resource Consumption + debian/patches/CVE-2026-27858.patch: [PATCH 2/2] managesieve- login: Verify AUTHENTICATE initial response size isn't too large + CVE-2026-27858 [Fixed upstream 2.4.4] - SECURITY UPDATE: Uncontrolled Resource Consumption + debian/patches/CVE-2026-27859.patch: [PATCH 03/24] lib-mail: Limit the number of RFC2231 parameters that can be parsed + CVE-2026-27859 [Fixed upstream 2.4.4] * New changes: - fix test segfault with openssl 4.0 (LP: #2154849) d/p/openssl4-dont-call-openssl-cleanup.patch - d/{control,rules}: Revert migration of dovecot-mysql to dovecot-mariadb As Ubuntu is still assessing if this is the way going forward. - d/t/mariadb/00_setup: switch to unix_socket auth method this is needed since we reverted the migration to mariadb and might be reconsidered in the next releases. (LP: #2162829) -- Hector Cao <[email protected]> Fri, 14 Aug 2026 16:29:17 +0200 ** Affects: dovecot (Ubuntu) Importance: Wishlist Status: New ** Tags: needs-merge upgrade-software-version ** Changed in: dovecot (Ubuntu) Importance: Undecided => Wishlist ** Changed in: dovecot (Ubuntu) Milestone: None => ubuntu-27.01 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171121 Title: Merge dovecot 1:2.4.5+dfsg1-4 from Debian for tenacious cycle To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/dovecot/+bug/2171121/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
