Commits on Jan 4, 2021

1. dovecot: 2.3.11.3 -> 2.3.13 …

   This fixes CVE_2020-24386, CVE-2020-25725 and a bunch of regular bugs
   [1].
   
   * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
   	  allow logged in user to access other people's emails and filesystem
   	  information.
   
   * CVE-2020-25275: Mail delivery / parsing crashed when the 10 000th MIME part was
     message/rfc822 (or if parent was multipart/digest). This happened
     due to earlier MIME parsing changes for CVE-2020-12100.
   
   [1] https://raw.githubusercontent.com/dovecot/core/2.3.13/NEWS
   
   (cherry picked from commit 58c7d3f)

   

   andir committed Jan 4, 2021
   Copy the full SHA

   1925a37 View commit details

   Browse the repository at this point in the history

2. dovecot: add the dovecot NixOS test to passthru.tests …

   While we already had some test we might as well add the test for that
   exact package to the tests attribute set. After all that should be what
   (primarily) tests dovecot.
   
   (cherry picked from commit 4fee20e)

   

   andir committed Jan 4, 2021
   Copy the full SHA

   843b063 View commit details

   Browse the repository at this point in the history

3. dovecot_pigeonhole: 0.5.11 -> 0.5.13 …

   This updates to the latest version. According to the changelog 0.5.12
   was skipped. The changes in this release are required to be compatible
   with the latest dovecot release.
   
   Changes:
     - duplicate: The test was handled badly in a multiscript (sieve_before,
       sieve_after) scenario in which an earlier script in the sequence with
       a duplicate test succeeded, while a later script caused a runtime
       failure. In that case, the message is recorded for duplicate tracking,
       while the message may not actually have been delivered in the end.
     - editheader: Sieve interpreter entered infinite loop at startup when
       the "editheader" configuration listed an invalid header name. This
       problem can only be triggered by the administrator.
     - relational: The Sieve relational extension can cause a segfault at
       compile time. This is triggered by invalid script syntax. The segfault
       happens when this match type is the last argument of the test command.
       This situation is not possible in a valid script; positional arguments
       are normally present after that, which would prevent the segfault.
     - sieve: For some Sieve commands the provided mailbox name is not
       properly checked for UTF-8 validity, which can cause assert crashes at
       runtime when an invalid mailbox name is encountered. This can be
       caused by the user by writing a bad Sieve script involving the
       affected commands ("mailboxexists", "specialuse_exists").
       This can be triggered by the remote sender only when the user has
       written a Sieve script that passes message content to one of the
       affected commands.
     - sieve: Large sequences of 8-bit octets passed to certain Sieve
       commands that create or modify message headers that allow UTF-8 text
       (vacation, notify and addheader) can cause the delivery or IMAP
       process (when IMAPSieve is used) to enter a memory-consuming
       semi-infinite loop that ends when the process exceeds its memory
       limits. Logged in users can cause these hangs only for their own
       processes.
   (cherry picked from commit bedb352)

   

   andir committed Jan 4, 2021
   Copy the full SHA

   1847328 View commit details

   Browse the repository at this point in the history

4. nixos/tests/dovecot: enable dovecot_pigeonhole plugin …

   This plugin is used commonly enough that we should ensure it still
   builds (and dovecot works) after loading it.
   
   This is not yet perfect as we aren't testing any of it's functionality
   but at least we ensure that dovecot continues to do the regular job.
   
   (cherry picked from commit 653f805)

   

   andir committed Jan 4, 2021
   Copy the full SHA

   ce9ec8b View commit details

   Browse the repository at this point in the history

5. Merge pull request #108405 from andir/20.09/dovecot …

   [20.09] dovecot: 2.3.11.3 -> 2.3.13

   

   dotlambda committed Jan 4, 2021
   Copy the full SHA

   1889c29 View commit details

   Browse the repository at this point in the history