8.14.5/8.14.5 2011/05/17
Do not cache SMTP extensions across connections as the cache
is based on hostname which may not be a unique identifier
for a server, i.e., different machines may have the
same hostname but provide different SMTP extensions.
Problem noted by Jim Hermann.
Avoid an out-of-bounds access in case a resolver reply for a DNS
map lookup returns a size larger than 1K. Based on a
patch from Dr. Werner Fink of SuSE.
If a job is aborted using the interrupt signal (e.g., control-C from
the keyboard), perform minimal cleanup to avoid invoking
functions that are not signal-safe. Note: in previous
versions the mail might have been queued up already
and would be delivered subsequently, now an interrupt
will always remove the queue files and thus prevent
delivery.
Per RFC 6176, when operating as a TLS client, do not offer SSLv2.
Since TLS session resumption is never used as a client, disable
use of RFC 4507-style session tickets.
Work around gcc4 versions which reverse 25 years of history and
no longer align char buffers on the stack, breaking calls
to resolver functions on strict alignment platforms.
Found by Stuart Henderson of OpenBSD.
Read at most two AUTH lines from a server greeting (up to two
lines are read because servers may use "AUTH mechs" and
"AUTH=mechs"). Otherwise a malicious server may exhaust
the memory of the client. Bug report by Nils of MWR
InfoSecurity.
Avoid triggering an assertion in the OpenLDAP code when the
connection to an LDAP server is lost while making a query.
Problem noted and patch provided by Andy Fiddaman.
If ConnectOnlyTo is set and sendmail is compiled with NETINET6
it would try to use an IPv6 address if an IPv4 (or
unparseable) address is specified.
If SASLv2 is used, make sure that the macro {auth_authen} is
stored in xtext format to avoid problems with parsing
it. Problem noted by Christophe Wolfhugel.
CONFIG: FEATURE(`ldap_routing') in 8.14.4 tried to add a missing
-T<TMPF> that is required, but failed for some cases
that did not use LDAP. This change has been undone
until a better solution can be implemented. Problem
found by Andy Fiddaman.
CONFIG: Add cf/ostype/solaris11.m4 for Solaris11 support.
Contributed by Casper Dik of Oracle.
CONTRIB: qtool.pl: Deal with H entries that do not have a
letter between the question marks. Patch from
Stefan Christensen.
DOC: Use a better description for the -i option in sendmail.
Patch from Mitchell Berger.
Portability:
Add support for Darwin 10.x (Mac OS X 10.6).
Enable HAVE_NANOSLEEP for FreeBSD 3 and later. Patch
from John Marshall.
Enable HAVE_NANOSLEEP for OpenBSD 4.3 and later.
Use new directory "/system/volatile" for PidFile on
Solaris 11. Patch from Casper Dik of Oracle.
Fix compilation on Solaris 11 (and maybe some other
OSs) when using OpenSSL 1.0. Based on patch from
Jan Pechanec of Oracle.
Set SOCKADDR_LEN_T and SOCKOPT_LEN_T to socklen_t
for Solaris 11. Patch from Roger Faulkner of Oracle.
New Files:
cf/ostype/solaris11.m4
== Tue Apr 26 09:49:54 UTC 2011 Mikel Lindsaar <mikel@rubyx.com>
* Update activesupport require to use inflector - closes#217
== Tue Apr 26 06:18:19 UTC 2011 Mikel Lindsaar <mikel@rubyx.com>
* Fixed charset warning issue with multipart messages - https://github.com/arvindsv
* Version bump to 2.2.18 and gem release
== Wed 20 Apr 2011 15:16:20 UTC Mikel Lindsaar <mikel@rubyx.com>
* Mail::Field.new("Subject: foobar", 'iso-2022-jp') does not set charset - https://github.com/yalab
== Tue Apr 19 00:20:54 UTC 2011 Mikel Lindsaar <mikel@rubyx.com>
* Fixed an exception with nil in Reply-To and References field - https://github.com/dcormier
* Version bump to 2.2.17 and gem release
== Sat Apr 16 12:57:27 UTC 2011 Mikel Lindsaar <mikel@rubyx.com>
* Added support for open SMTP connections and returning the Mail server's response - https://github.com/spiegela
* RE: not appended to subject when replying to a reply - https://github.com/prateekdayal
* Support not ascii compatible charset mail send - https://github.com/yalab
* Fix for issue 208 "mail.body after mail.add_file truncates message body" - https://github.com/glongman
* Handle bad subject encoding (or ":invalid => :replace" is ineffective for utf-8 to utf-8 encoding) - https://github.com/choonkeat
* Handle blank Received header field - https://github.com/bcantin
* Handle part with missing content type - https://github.com/bcantin
* Handle a "<>" Return field - https://github.com/bcantin
* Performance improvements for 1.9 - https://github.com/nobu
* Fix heavy CPU issues when messages are missing a space - https://github.com/scsmith
* Tighten up allowed encodings - https://github.com/scsmith
* Added to_yaml & from_yaml (as well as to_hash & from_hash) - https://github.com/srushti
* Fix up some comments - https://github.com/takahashim
* Version bump to 2.2.16 and gem release
Update MANAGESIEVE_VERSION to 0.11.13, for dovecot-1.2.17.
rest part of PR#44970.
Sieve:
v0.1.19 19-05-2011 Stephan Bosch <stephan@rename-it.nl>
- Enotify extension: fixed inappropriate return type in mailto URI parse
function, also fixing ARM compiler warning.
- Vacation extension: fixed handling of sendmail errors. It produced an
additional confusing success message in case of error.
- Removed header MIME-decoding to fix erroneous address parsing. Applies to
address test and vacation command.
ManageSieve:
v0.11.13:
- ManageSieve: fixed bug in UTF-8 checking of string values.
Requested by PR#45030.
fetchmail-6.3.20 (released 2011-06-06, 26005 LoC):
# SECURITY BUG FIXES
* CVE-2011-1947:
STARTTLS: Fetchmail runs the IMAP STARTTLS or POP3 STLS negotiation with the
set timeout (default five minutes) now. This was reported missing, with
observed fetchmail freezes beyond a week, by Thomas Jarosch.
SSL-wrapped connections were unaffected by this timeout, so users of older
versions can force ssl-wrapped connections -- if supported by the server --
with the --ssl command line or ssl rcfile option.
See fetchmail-SA-2011-01.txt for further details.
# BUG FIXES
* IMAP: Do not search for UNSEEN messages in ranges. Usually, there are very few
new messages and most of the range searches result in nothing. Instead, split
the long response to make the IMAP driver think that there are multiple lines
of response. (Sunil Shetye)
* Do not print "skipping message" for old messages even in verbose mode. If
there are too many old messages, the logs just get filled without any real
activity. (Sunil Shetye) (suggested by Yunfan Jiang)
* Build: fetchmail now always uses its own MD5 implementation rather than trying
to find a system library with matched header. The library and header variants
found on systems are too diverse, and the code size saving is not worth any
more wasted user or programmer time.
# CHANGES
* Call strlen() only once when removing CRLF from a line. (Sunil Shetye)
* fetchmail sets Internet domain sockets to "keepalive" mode now. Note that
there is no portable way to configure actual timeouts for this mode, and some
systems only support a system-wide timeout setting. fetchmail does not
attempt to tune the time spans of keepalive mode.
# TRANSLATION UPDATES
[cs] Chech (Petr Pisar)
[nl] Dutch (Erwin Poeze)
[fr] French (Frédéric Marchal)
[de] German (Matthias Andree)
[ja] Japanese (Takeshi Hamasaki)
[pl] Polish (Jakub Bogusz)
[sk] Slovak (Marcel Telka)
# KNOWN BUGS AND WORKAROUNDS
(this section floats upwards through the NEWS file so it stays with the
current release information - however, it was stuck with 6.3.8 for a while)
* fetchmail does not handle messages without Message-ID header well
(See sourceforge.net bug #780933)
* BSMTP is mostly untested and errors can cause corrupt output.
* Sun Workshop 6 (SPARC) is known to miscompile the configuration file lexer in
64-bit mode. Either compile 32-bit code or use GCC to compile 64-bit
fetchmail. Note that fetchmail doesn't take advantage of 64-bit code,
so compiling 32-bit SPARC code should not cause any difficulties.
* fetchmail does not track pending deletes over crashes.
* the command line interface is sometimes a bit stubborn, for instance,
fetchmail -s doesn't work with a daemon running.
* Linux systems may return duplicates of an IP address in some circumstances if
no or no global IPv6 addresses are configured.
(No workaround. Ubuntu Bug#582585, Novell Bug#606980.)
* Kerberos 5 may be broken, particularly on Heimdal, and provide bogus error
messages. This will not be fixed, because the maintainer has no Kerberos 5
server to test against. Use GSSAPI.
fetchmail-6.3.19 (released 2010-12-10, 25945 LoC):
# ERRATUM NOTICE ISSUED
* fetchmail 6.3.18 contains several bug fixes that were considered sufficiently
grave to warrant the issue of an erratum notice, fetchmail-EN-2010-03.txt.
# BUG FIXES
* When specifying multiple local multidrop lists, do not lose wildcard flag.
(Affects "user foo is bar baz * is joe here")
* In multidrop configurations, an asterisk can now appear anywhere in the list
of local users, not just at the end.
* In multidrop mode, header parsing is now more verbose in -vv mode, so that it
becomes possible to see which header is used.
* Make --antispam work from command line (these used to work in rcfiles).
Reported by Kees Bakker, BerliOS Bug #17599. (Sunil Shetye)
* Smoke test XHTML 1.1 validation, and if it fails, skip validating HTML
documents. Skip validating Mailbox-Names-UTF7.html. Several systems have
broken XHTML 1.1 DTD installations that jeopardize the build.
Reported by Mihail Nechkin against FreeBSD port.
Workaround for 6.3.18: build in a separate directory, i. e:
mkdir build && cd build && ../configure --options-go-here
* Send a NOOP only after a failed STARTTLS in IMAP. (Sunil Shetye)
* Demote GSSAPI verbose/debug syslog to INFO severity. Requested by Carlos E. R.
and Derek Simkowiak via the fetchmail-users@ mailing list.
* Do STARTTLS/STLS negotiation in IMAP/POP3 if it is mandatory even if the
server capabilities do not show support for upgradation to TLS.
To use this, configure --sslproto tls1. (Sunil Shetye)
* IMAP: Understand empty strings as FETCH response, seen on Yahoo. Reported by
Yasin Malli to fetchmail-users@ 2010-12-10.
Note that fetchmail continues to expect literals as FETCH response for now.
# DOCUMENTATION
* The manual page now links to IANA for GSSAPI service names.
# TRANSLATION UPDATES
[cs] Czech (Petr Pisar)
[fr] French (Frédéric Marchal)
[de] German
[it] Italian (Vincenzo Campanella)
[pl] Polish (Jakub Bogusz)
fetchmail-6.3.18 (released 2010-10-09, 25936 LoC):
# SECURITY IMPROVEMENTS TO DEFANG X.509 CERTIFICATE ABUSE
* Fetchmail now only accepts wildcard certificate common names and subject
alternative names if they start with "*.". Previous versions would accept
wildcards even if no period followed immediately.
* Fetchmail now disallows wildcards in certificates to match domain literals
(such as 10.9.8.7), or wildcards in domain literals ("*.168.23.23").
The test is overly picky and triggers if the pattern (after skipping the
initial wildcard "*") or domain consists solely of digits and dots, and thus
matches more than needed.
* Fetchmail now disallows wildcarding top-level domains.
# CRITICAL BUG FIXES AND REGRESSION FIXES
* Fetchmail 6.3.15, 6.3.16, and 6.3.17 would pick up libmd5 to obtain MD5*
functions, as an effect of an undocumented Solaris MD5 fix.
This caused all MD5-related functions to malfunction if, for instance,
libmd5.so was installed on other operating systems as part of libwww on
machines where long isn't 32-bits, i. e. usually on 64-bit computers.
Fixes Gentoo Bug #319283, reported, including libwww hint, by Karl Hakimian.
Side effect: fetchmail will now use -lmd on Solaris rather than -lmd5.
* Fetchmail 6.3.17 warned about insecure SSL/TLS connections even if a matching
--sslfingerprint was specified. This is an omission from an SSL usability
change made in 6.3.17.
Fixes Debian Bug#580796 reported by Roland Stigge.
* Fetchmail will now apply timeouts to the authentication stage.
This stage encompasses STARTTLS/STLS negotiation in IMAP/POP3.
Reported missing by Thomas Jarosch.
* Fetchmail now cancels GSSAPI authentication properly when encountering GSS
errors, such as no or unsuitable credentials.
It now sends an asterisk on a line by its own, as required in SASL.
This fixes protocol synchronization issues that cause Authentication
failures, often observed with kerberized MS Exchange servers.
Fixes Debian Bug #568455 reported by Patrick Rynhart, and Alan Murrell, to the
fetchmail-users list. Fix verified by Thomas Voigtmann and Patrick Rynhart.
# BUG FIXES
* Fetchmail will no longer print connection attempts and errors for one host
in "silent" and "normal" logging modes, unless all connections fail. This
should reduce irritation around refused-connection logging if services are
only on an IPv4 socket if the host also supports IPv6. Often observed as
connections refused to ::1/25 when the subsequent connection to 127.0.0.1/25
then - silently - succeeds. Fetchmail, unless in verbose mode, will collect
all connect errors and only report them if all of them fail.
* Fetchmail will not try GSSAPI authentication automatically, unless it has GSS
credentials. However, if GSSAPI authentication is requested explicitly,
fetchmail will always try it.
* Fetchmail now parses response to "FETCH n:m RFC822.SIZE" and "FETCH n
RFC822.HEADER" in a more flexible manner. (Sunil Shetye)
* The manual page clearly states that --principal is for Kerberos 4 only, not
for Kerberos 5 or GSSAPI. Found by Thomas Voigtmann.
# CHANGES
* When encountering incorrect headers, fetchmail will refer to the bad-header
option in the manpage.
Fixes BerliOS Bug #17272, change suggested by Björn Voigt.
* Fetchmail now decodes and reports GSSAPI status codes upon errors.
* Fetchmail now autoprobes NTLM also for POP3.
* The Fetchmail FAQ has a new item #R15 on authentication failures.
# INTERNAL CHANGES
* The common NTLM authentication code was factored out from pop3.c and imap.c.
# TRANSLATION UPDATES
[zh_CN] Chinese/simplified (Ji Zheng-Yu)
[cs] Czech (Petr Pisar)
[nl] Dutch (Erwin Poeze)
[fr] French (Frédéric Marchal)
[de] German
[it] Italian (Vincenzo Campanella)
[ja] Japanese (Takeshi Hamasaki)
[pl] Polish (Jakub Bogusz)
[sk] Slovak (Marcel Telka)
* Potentially safer method for writing feeds.dat on UNIX
* Handle via links with no title attribute
* Handle attributes more cleanly with OVERRIDE_EMAIL and DEFAULT_EMAIL
- Tiny changes for Perl 5.12.
- Build scripts are updated.
Use `sysconfdir' instead of `libdir' for the configuration file.
${DESTDIR) is prepended to each installed target.
- Fix ratelimit sliding window for computing average
- Fix p0f port byte order (Enrico Scholz)
- Fix milter-greylist.m4 for newer Sendmail (Joe Pruett)
- Fix autoconf warning about --datarootdir (R P Herrold)
* Added "doveadm index" command to add unindexed messages into
index/cache. If full text search is enabled, it also adds unindexed
messages to the fts database.
* added "doveadm director dump" command.
* pop3: Added support for showing messages in "POP3 order", which can
be different from IMAP message order. This can be useful for
migrations from other servers. Implemented it for Maildir as 'O'
field in dovecot-uidlist.
* doveconf: Fixed a wrong "subsection has ssl=yes" warning.
* mdbox purge: Fixed wrong warning about corrupted extrefs.
* sdbox: INBOX GUID changed when INBOX was autocreated, leading to
trouble with dsync.
* script-login binary wasn't actually dropping privileges to the
user/group/chroot specified by its service settings.
* Fixed potential crashes and other problems when parsing header names
that contained NUL characters.
* Fixed potential crashes and other problems when parsing header names
that contained NUL characters.
* IMAP: Fixed a memory leak with ESEARCH command handling
* Quota warnings could have been executed at incorrect times with
some configs.
* pkgsrc change: remoe mysql4 from PKG_OPTIONS.
Securiy release for Memory corruption in Postfix SMTP server Cyrus SASL
support: http://www.postfix.org/CVE-2011-1720.html
20110411
Cleanup: postscreen(8) and verify(8) daemons now lock their
respective cache file exclusively upon open, to avoid massive
cache corruption by unsupported sharing. Files: util/dict.h,
util/dict_open.c, verify/verify.c, postscreen/postscreen.c.
20110414
Bugfix (introduced with Postfix SASL patch 20000314): don't
reuse a server SASL handle after authentication failure.
Problem reported by Thomas Jarosch of Intra2net AG. File:
smtpd/smtpd_proto.c.
* The new ldap_require_cert option would segfault if used. Fixed.
* Harmonised TLS library version reporting; only show if debugging.
Layout now matches that introduced for other libraries in 4.74 PP/03.
* New openssl_options items: no_sslv2 no_sslv3 no_ticket no_tlsv1
* New "dns_use_edns0" global option.
* Don't segfault on misconfiguration of ref:name exim-user as uid.
* Extra paranoia around buffer usage at the STARTTLS transition.
nb: Exim is not vulnerable to http://www.kb.cert.org/vuls/id/555316
* Updated PolarSSL code to 0.14.2.
* Catch divide-by-zero in ${eval:...}.
* Condition negation of bool{}/bool_lax{} did not negate. Fixed.
* CVE-2011-1764 - DKIM log line was subject to a format-string attack --
SECURITY: remote arbitrary code execution.
* SECURITY - DKIM signature header parsing was double-expanded, second
time unintentionally subject to list matching rules, letting the header
cause arbitrary Exim lookups (of items which can occur in lists, *not*
arbitrary string expansion). This allowed for information disclosure.
* Fix another SIGFPE (x86) in ${eval:...} expansion, this time related to
INT_MIN/-1 -- value coerced to INT_MAX.
From homepage:
"This release contains many improvements for usability. The features
requested by many users, such as combining partial messages, removal of
attachments, automatic address completion, etc., were added. The feature
to assist the migration from Outlook Express has been added. Various
bugfixes have been also made."
Changelog:
Version 1.4.24:
- Remove the unmaintained pt_BR translation.
- Simplify manual license: use a simple permissive license instead of GNU FDL.
- Replace a call to gnutls_protocol_set_priority(), which is deprecated in
GnuTLS >= 2.12.0. Fixes Debian bug #624048 (reported for mpop).
- Remove gnulib, for simplicity and maintainability.
- Update GNU autotools files, in particular configure.ac.
Fix bug #SF3067338: Create a pool of DB handles for SQL operations
so that queries don't all share one serially.
Fix bug #SF3156559: Don't compile Lua scripts anew for each execution.
Fix bug #SF3210385: Fix issue with configuration reload failures
having some side effects on the remaining active configuration
handle. Reported by Andreas Schulze.
Fix bug #SF3235131: Don't report ADSP errors as signature errors
in Authentication-Results header fields.
Fix bug #SF3258459: Don't send progress messages during EOH. Problem
reported by Gary Mills.
Fix bug #SF3276469: When generating "z=" tags, apply omit and sign
header field lists. Problem noted by Todd Lyons.
Add ADSP processing error information to A-R header fields.
LIBOPENDKIM: Use a time_t to store TTL and clock drift options
rather than unsigned long. Patch from Piotr Sikora.
LIBAR: Include class and type in debugging messages. Suggested
by Gary Mills.
LIBAR: Start the dispatcher on the first query, not in ar_init().
Allows ar_init() to be called before a fork() safely.
CONTRIB: Adjust installed path in RedHat start script. Patch
from Naresh V.
CONTRIB: Require the current libopendkim in the opendkim definition
in the RPM spec file. Patch from Naresh V.
2.3.1 2011/03/28
Feature request #SF3196060: Log retrieved reputation values.
Patch from Andreas Schulze.
Feature request #SF3199824: Don't log "no signature data" unless
LogWhy is enabled or the action for unsigned mail is something
other than "accept".
Fix bug #SF3196069: Log more detail when dkimf_config_setlib() fails.
Problem noted by Andreas Schulze.
Fix bug #SF3197890: Update ARF report format for DKIM verification
failures to use what's in draft-ietf-dkim-marf-reporting.
Fix bug #SF3204725: Add "ReplaceHeaders" data set to constrain what
header fields are affected by "ReplaceRules". Problem
noted by Chris Callegari.
Fix bug #SF3211114: Extract "BaseDirectory" from configuration
file properly.
Fix bug #SF3234178: Correct handling of a KeyTable entry for which the
key data is empty. Based on a patch from Yoshiaki Yanagihara.
Patch #SF3205699: Make all header field name and domain name data
sets case insensitive. Submitted by Richard Rognlie.
Add a case-insensitivity flag to odkim.db_open().
Minor correction to DNS function return codes for unbound, which
doesn't have an expired/no-reply distinction like libar does.
LIBOPENDKIM: Fix up timeout handling with a DNS callback is in use.
LIBOPENDKIM: Update for draft-kucherawy-dkim-atps-03.
STATS: Fix bug #SF3195449: Omit data from reporters that are not
currently marked "enabled" in the reporters table.
STATS: Evaluate "i=" against the "d=" domain, not the "From" domain.
Problem noted by Mark Martinec.
STATS: A few more reports.
MILTERTEST: Don't use non-standard printf() conversions.
MILTERTEST: Get the SMFIP_HDR_LEADSPC logic right.
TOOLS: Feature request #SF3200848: Add a backgrounding option
(on by default) to opendkim-spam.
* TinyMCE 3.4.2 now compatible with IE9
* PEAR::Net_SMTP 1.5.2, fixed timeout issue
* Fix bug where template name without plugin prefix was used in render_page hook
* Support 'abort' and 'result' response in 'preferences_save' hook, add error
handling
* Fix bug where some content would cause hang on html2text conversion
* Improve space-stuffing handling in format=flowed messages
* Fix bug where some dates would produce SQL error in MySQL
* Added workaround for some IMAP server with broken STATUS response
* Fix bug where default_charset was not used for text messages
* Stateless request tokens. No keep-alive necessary on login page
* Force names of unique constraints in PostgreSQL DDL
* Add code for prevention from IMAP connection hangs when server closes socket
unexpectedly
* Remove redundant DELETE query (for old session deletion) on login
* Get around unreliable rand() and mt_rand() in session ID generation
* Fix some emails are not shown using Cyrus IMAP
* Fix handling of mime-encoded words with non-integral number of octets in
a word
* Fix parsing links with non-printable characters inside
* Fixed de_CH/de_DE localization bugs
* Add variable for 'Today' label in date_today option
* Applied plugin changes since 0.5-stable release
* Fix SQL query in rcube_user::query() so it uses index on MySQL again
* Use only one from IMAP authentication methods to prevent login delays
* Fix strftime format support in date_today option
* Removed redundant </form> tags from contact add/edit pages
* Fix CSS error in contact details screen on IE7
