Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[17.09] dovecot: fix CVE-2017-15132 #34482

Merged
merged 2 commits into from Feb 1, 2018
Merged

[17.09] dovecot: fix CVE-2017-15132 #34482

merged 2 commits into from Feb 1, 2018

Conversation

andir
Copy link
Member

@andir andir commented Feb 1, 2018

Motivation for this change

fixes CVE-2017-15132 & bumps to latest patch version of the 2.2 branch

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Fits CONTRIBUTING.md.

@andir
dovecot: 2.2.32 -> 2.2.33.2
e31406f 
Various bugfixes and minor changes:

 - doveadm: Fix crash in proxying (or dsync replication) if remote is
   running older than v2.2.33
 - auth: Fix memory leak in %{ldap_dn}
 - dict-sql: Fix data types to work correctly with Cassandra
 - dovecot-lda was logging to stderr instead of to the log file.
 * doveadm director commands wait for the changes to be visible in the
   whole ring before they return. This is especially useful in testing.
 * Environments listed in import_environment setting are now set or
   preserved when executing standalone commands (e.g. doveadm)
 + doveadm proxy: Support proxying logs. Previously the logs were
   visible only in the backend's logs.
 + Added %{if}, see https://wiki2.dovecot.org/Variables#Conditionals
 + Added a new notify_status plugin, which can be used to update dict
   with current status of a mailbox when it changes. See
   https://wiki2.dovecot.org/Plugins/NotifyStatus
 + Mailbox list index can be disabled for a namespace by appending
   ":LISTINDEX=" to location setting.
 + dsync/imapc: Added dsync_hashed_headers setting to specify which
   headers are used to match emails.
 + pop3-migration: Add pop3_migration_ignore_extra_uidls=yes to ignore
   mails that are visible in POP3 but not IMAP. This could happen if
   new mails were delivered during the migration run.
 + pop3-migration: Further improvements to help with Zimbra
 + pop3-migration: Cache POP3 UIDLs in imapc's dovecot.index.cache
   if indexes are enabled. These are used to optimize incremental syncs.
 + cassandra, dict-sql: Use prepared statements if protocol version>3.
 + auth: Added %{ldap_dn} variable for passdb/userdb ldap
 - acl: The "create" (k) permission in global acl-file was sometimes
   ignored, allowing users to create mailboxes when they shouldn't have.
 - sdbox: Mails were always opened when expunging, unless
   mail_attachment_fs was explicitly set to empty.
 - lmtp/doveadm proxy: hostip passdb field was ignored, which caused
   unnecessary DNS lookups if host field wasn't an IP
 - lmtp proxy: Fix crash when receiving unexpected reply in RCPT TO
 - quota_clone: Update also when quota is unlimited (broken in v2.2.31)
 - mbox, zlib: Fix assert-crash when accessing compressed mbox
 - doveadm director kick -f parameter didn't work
 - doveadm director flush <host> resulted flushing all hosts, if <host>
   wasn't an IP address.
 - director: Various fixes to handling backend/director changes at
   abnormal times, especially while ring was unsynced. These could have
   resulted in crashes, non-optimal behavior or ignoring some of the
   changes.
 - director: Use less CPU in imap-login processes when moving/kicking
   many users.
 - lmtp: Session IDs were duplicated/confusing with multiple RCPT TOs
   when lmtp_rcpt_check_quota=yes
 - doveadm sync -1 fails when local mailboxes exist that do not exist
   remotely. This commonly happened when lazy_expunge mailbox was
   autocreated when incremental sync expunged mails.
 - pop3: rawlog_dir setting didn't work
@andir
Copy link
Member Author

andir commented Feb 1, 2018

@GrahamcOfBorg test dovecot

@GrahamcOfBorg
Copy link

Failure on x86_64-linux (full log)

Partial log (click to expand)

building path(s) ‘/nix/store/54rqcdf3bp6q5q7pxi1zrpzip2dizspj-unit-systemd-vconsole-setup.service’
cannot build derivation ‘/nix/store/1arrhm09rkwlrfix4bwmj0w1jjvv7m94-system-units.drv’: 4 dependencies couldn't be built
cannot build derivation ‘/nix/store/qzdrmynrjpkysgf996lvpwqm1map0pv0-etc.drv’: 5 dependencies couldn't be built
cannot build derivation ‘/nix/store/ihzlshqiz8jambiqbqdqzxvgdg672n7s-nixos-system-machine-17.09.git.f40bb58.drv’: 2 dependencies couldn't be built
cannot build derivation ‘/nix/store/gk81qrw2igq8ym0821akw01pix0kz31w-reginfo.drv’: 1 dependencies couldn't be built
cannot build derivation ‘/nix/store/nplkidkxx9r7zpxfxgq8f1957i3dfc8v-run-nixos-vm.drv’: 2 dependencies couldn't be built
cannot build derivation ‘/nix/store/7hqf8qkj3pyvapg7vifr2dd73jra1rbf-nixos-vm.drv’: 2 dependencies couldn't be built
cannot build derivation ‘/nix/store/83km4dlcbjzlj2x500ry4isiv7l3if9j-nixos-test-driver-dovecot.drv’: 1 dependencies couldn't be built
cannot build derivation ‘/nix/store/ywvfv6rq1rb4rl4ac6rlrwbvfanzyrn0-vm-test-run-dovecot.drv’: 1 dependencies couldn't be built
error: build of ‘/nix/store/ywvfv6rq1rb4rl4ac6rlrwbvfanzyrn0-vm-test-run-dovecot.drv’ failed

@andir andir force-pushed the 17.09/dovecot-cve-2017-15132 branch from f40bb58 to 7c34d16 Compare February 1, 2018 03:30
@andir
Copy link
Member Author

andir commented Feb 1, 2018

@GrahamcOfBorg test dovecot

@GrahamcOfBorg
Copy link

Success on x86_64-linux (full log)

Partial log (click to expand)

machine: exit status 1
syncing
machine: running command: sync
machine: exit status 0
test script finished in 147.65s
cleaning up
killing machine (pid 143)
vde_switch: EOF on stdin, cleaning up and exiting
vde_switch: Could not remove ctl dir '/tmp/nix-build-vm-test-run-dovecot.drv-0/vde1.ctl': Directory not empty
/nix/store/5s6z7f6hcap19gvmb18y6mhmfb5118fm-vm-test-run-dovecot

@andir andir merged commit b69010b into NixOS:release-17.09 Feb 1, 2018
@andir andir deleted the 17.09/dovecot-cve-2017-15132 branch February 1, 2018 03:54
@GrahamcOfBorg
Copy link

Failure on aarch64-linux (full log)

Partial log (click to expand)

installing
post-installation fixup
shrinking RPATHs of ELF executables and libraries in /nix/store/8p8wcff8fknsb59m9q9jhl7vfya9vd9r-nixos-test-driver
stripping (with flags -S) in /nix/store/8p8wcff8fknsb59m9q9jhl7vfya9vd9r-nixos-test-driver/lib  /nix/store/8p8wcff8fknsb59m9q9jhl7vfya9vd9r-nixos-test-driver/bin
patching script interpreter paths in /nix/store/8p8wcff8fknsb59m9q9jhl7vfya9vd9r-nixos-test-driver
/nix/store/8p8wcff8fknsb59m9q9jhl7vfya9vd9r-nixos-test-driver/bin/.nixos-test-driver-wrapped: interpreter directive changed from " /somewhere/perl -w" to "/nix/store/b5a764yzqpgx03xyhd4kayipzpy84a6m-perl-5.24.3/bin/perl -w"
checking for references to /build in /nix/store/8p8wcff8fknsb59m9q9jhl7vfya9vd9r-nixos-test-driver...
cannot build derivation '/nix/store/awdsapvmvqrw54b0v2snn46k6avh3nf0-nixos-test-driver-dovecot.drv': 1 dependencies couldn't be built
cannot build derivation '/nix/store/xhhfiqgmxp3bvkr14g0aj6ryfy8hsdqn-vm-test-run-dovecot.drv': 1 dependencies couldn't be built
error: build of '/nix/store/xhhfiqgmxp3bvkr14g0aj6ryfy8hsdqn-vm-test-run-dovecot.drv' failed

@GrahamcOfBorg
Copy link

Failure on aarch64-linux (full log)

Partial log (click to expand)

cannot build derivation '/nix/store/qqyr2v8ylw6y9xdp5mmkdsbpqissk13y-system-units.drv': 4 dependencies couldn't be built
cannot build derivation '/nix/store/8k3lg5643y4x4a6jw5807nksnqsrfxf3-user-units.drv': 1 dependencies couldn't be built
cannot build derivation '/nix/store/nlvq6ljqn50bfchbyqjhjhpkpdqvj2dn-etc.drv': 5 dependencies couldn't be built
cannot build derivation '/nix/store/sbk8lqzlsrd9cnhxnsaixl95npph8j83-nixos-system-machine-17.09.git.b69010b.drv': 2 dependencies couldn't be built
cannot build derivation '/nix/store/zzw6k1dhp81ssx404lpgjd28y0hwjcyy-reginfo.drv': 1 dependencies couldn't be built
cannot build derivation '/nix/store/s3ddwhxfb122w1vbp0b45nrcqp4bnlx8-run-nixos-vm.drv': 2 dependencies couldn't be built
cannot build derivation '/nix/store/wfjqxs5im4pg3sf35fngg718a1n14wir-nixos-vm.drv': 2 dependencies couldn't be built
cannot build derivation '/nix/store/q94zv374p5w3k365z4rwh0qf6iqndna0-nixos-test-driver-dovecot.drv': 1 dependencies couldn't be built
cannot build derivation '/nix/store/badmjwg0d104gvndirw69mvxs48nxpwh-vm-test-run-dovecot.drv': 1 dependencies couldn't be built
error: build of '/nix/store/badmjwg0d104gvndirw69mvxs48nxpwh-vm-test-run-dovecot.drv' failed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
10.rebuild-darwin: 1-10 10.rebuild-linux: 1-10
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@andir @GrahamcOfBorg