- Dovecot-news - dovecot.org

CVE-2022-30550: Privilege escalation possible in dovecot when similar master and non-master passdbs are used
by Aki Tuomi 07 Jul '22

07 Jul '22

Affected product: Dovecot IMAP Server Internal reference: DOV-5320 Vulnerability type: Improper Access Control (CWE-284) Vulnerable version: 2.2 Vulnerable component: submission Report confidence: Confirmed Solution status: Fixed in main Researcher credits: Julian Brook (julezman) Vendor notification: 2022-05-06 CVE reference: CVE-2022-30550 CVSS: 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vulnerability Details: When two passdb configuration entries exist in Dovecot configuration, which have the same driver and args settings, the incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation with certain configurations involving master user authentication. Dovecot documentation does not advise against the use of passdb definitions which have the same driver and args settings. One such configuration would be where an administrator wishes to use the same pam configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user. Risk: If same passwd file or PAM is used for both normal and master users, it is possible for attacker to become master user. Workaround: Always authenticate master users from different source than regular users, e.g. using a separate passwd file. Alternatively, you can use global ACLs to ensure that only legimate master users have priviledged access. Fix: This has been fixed in main branch. See https://github.com/dovecot/core/compare/7bad6a24%5E..a1022072.patch

1 1

v2.3.19.1 released
by Aki Tuomi 14 Jun '22

14 Jun '22

Hi everyone! Due to a severe bug in doveadm deduplicate, we are releasing patch release 2.3.19.1. Please find it at locations below: https://dovecot.org/releases/2.3/dovecot-2.3.19.1.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.19.1.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Aki Tuomi Open-Xchange oy --- - doveadm deduplicate: Non-duplicate mails were deleted. v2.3.19 regression. - auth: Crash would occur when iterating multiple backends. Fixes: Panic: file userdb-blocking.c: line 125 (userdb_blocking_iter_next): assertion failed: (ctx->conn != NULL)

1 0

Pigeonhole v0.5.19 released
by Aki Tuomi 11 May '22

11 May '22

Hi all! We are pleased to release v0.5.19 of Pigeonhole. This release is done to maintain parity with dovecot 2.3.19 release, so it does not contain any news-worthy changes. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.18.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.18.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy

1 1

Dovecot v2.3.19 released
by Aki Tuomi 10 May '22

10 May '22

Hi all! We are pleased to release v2.3.19 of Dovecot. The docker images have been upgraded to use bullseye as base image. https://dovecot.org/releases/2.3/dovecot-2.3.19.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.19.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- + Added mail_user_session_finished event, which is emitted when the mail user session is finished (e.g. imap, pop3, lmtp). It also includes fields with some process statistics information. See https://doc.dovecot.org/admin_manual/list_of_events/ for more information. + Added process_shutdown_filter setting. When an event matches the filter, the process will be shutdown after the current connection(s) have finished. This is intended to reduce memory usage of long-running imap processes that keep a lot of memory allocated instead of freeing it to the OS. + auth: Add cache hit indicator to auth passdb/userdb finished events. See https://doc.dovecot.org/admin_manual/list_of_events/ for more information. + doveadm deduplicate: Performance is improved significantly. + imapc: COPY commands were sent one mail at a time to the remote IMAP server. Now the copying is buffered, so multiple mails can be copied with a single COPY command. + lib-lua: Add a Lua interface to Dovecot's HTTP client library. See https://doc.dovecot.org/admin_manual/lua/ for more information. - auth: Cache lookup would use incorrect cache key after username change. - auth: Improve handling unexpected LDAP connection errors/hangs. Try to fix up these cases by reconnecting to the LDAP server and aborting LDAP requests earlier. - auth: Process crashed if userdb iteration was attempted while auth-workers were already full handling auth requests. - auth: db-oauth2: Using %{oauth2:name} variables caused unnecessary introspection requests. - dict: Timeouts may have been leaked at deinit. - director: Ring may have become unstable if a backend's tag was changed. It could also have caused director process to crash. - doveadm kick: Numeric parameter was treated as IP address. - doveadm: Proxying can panic when flushing print output. Fixes Panic: file ioloop.c: line 865 (io_loop_destroy): assertion failed: (ioloop == current_ioloop). - doveadm sync: BROKENCHAR was wrongly changed to '_' character when migrating mailboxes. This was set by default to %, so any mailbox names containing % characters were modified to "_25". - imapc: Copying or moving mails with doveadm to an imapc mailbox could have produced "Error: Syncing mailbox '[...]' failed" Errors. The operation itself succeeded but attempting to sync the destination mailbox failed. - imapc: Prevent index log synchronization errors when two or more imapc sessions are adding messages to the same mailbox index files, i.e. INDEX=MEMORY is not used. - indexer: Process was slowly leaking memory for each indexing request. - lib-fts: fts header filters caused binary content to be sent to the indexer with non-default configuration. - doveadm-server: Process could hang in some situations when printing output to TCP client, e.g. when printing doveadm sync state. - lib-index: dovecot.index.log files were often read and parsed entirely, rather than only the parts that were actually necessary. This mainly increased CPU usage. - lmtp-proxy: Session ID forwarding would cause same session IDs being used when delivering same mail to multiple backends. - log: Log prefix update may have been lost if log process was busy. This could have caused log prefixes to be empty or in some cases reused between sessions, i.e. log lines could have been logged for the wrong user/session. - mail_crypt: Plugin crashes if it's loaded only for some users. Fixes Panic: Module context mail_crypt_user_module missing. - mail_crypt: When LMTP was delivering mails to both recipients with mail encryption enabled and not enabled, the non-encrypted recipients may have gotten mails encrypted anyway. This happened when the first recipient was encrypted (mail_crypt_save_version=2) and the 2nd recipient was not encrypted (mail_crypt_save_version=0). - pop3: Session would crash if empty line was sent. - stats: HTTP server leaked memory. - submission-login: Long credentials, such as OAUTH2 tokens, were refused during SASL interactive due to submission server applying line length limits. - submission-login: When proxying to remote host, authentication was not using interactive SASL when logging in using long credentials such as OAUTH2 tokens. This caused authentication to fail due to line length constraints in SMTP protocol. - submission: Terminating the client connection with QUIT command after mail transaction is started with MAIL command and before it is finished with DATA/BDAT can cause a segfault crash. - virtual: doveadm search queries with mailbox-guid as the only parameter crashes: Panic: file virtual-search.c: line 77 (virtual_search_get_records): assertion failed: (result != 0)

1 0

Notification about branch and versioning changes
by Aki Tuomi 03 Feb '22

03 Feb '22

Dear subscribers, This year we will be releasing a new Dovecot major release. In preparations for this, we are doing some repository changes, which will affect you if you are using our git repositories. These changes will become effective after 14th of February. Following branch name changes are going to be implemented: - main => this is going to be the main branch in future - master => release-2.3 Note that Dovecot version number on main branch is going to change. The next major CE release will be 2.4.x. The change to a main branch and its version numbering also apply to Pigeonhole. We will also align Pigeonhole release version to match Dovecot, ie. the next major is 2.4.x and not 0.6. We will send more information about the upcoming major release as it progresses. Regards, Aki Tuomi Open-Xchange oy

1 0

Pigeonhole v0.5.18 released
by Aki Tuomi 03 Feb '22

03 Feb '22

Hi all! We are pleased to release v0.5.18 of Pigeonhole. Debian/Stretch support has now been dropped. CentOS 8 packages have been replaced with RedHat Enterprise Linux 8 packages. These should be compatible with all the various variants. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.18.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.18.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- - duplicate: Users without a home directory can crash with Sieve when using duplicate database. v2.3.17 regression. - imapsieve: When mail was expunged when processing imapsieve events, a crash could occur. Fixes Panic: file mail-index-map.c: line 558 (mail_index_map_lookup_seq_range): assertion failed: (first_uid > 0) - managesieve-login: Proxy didn't support forwarding the forward_* passdb fields. - redirect: Sieve would crash if redirect after keep-equivalent action failed. - sieve: Interpreter crashes when the Sieve index extension is used with index zero. - vnd.dovecot.filter: Envelope sender string may become corrupted when Sieve scripts are using vnd.dovecot.filter. This could end up corrupting mbox's From line and return wrong envelope sender string in

1 0

Dovecot v2.3.18 released
by Aki Tuomi 03 Feb '22

03 Feb '22

Hi all! We are pleased to release v2.3.18 of Dovecot. Debian/Stretch support has now been dropped. CentOS 8 packages have been replaced with RedHat Enterprise Linux 8 packages. These should be compatible with all the various variants. https://dovecot.org/releases/2.3/dovecot-2.3.18.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.18.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- * Removed mail_cache_lookup_finished event. This event wasn't especially useful, but it increased CPU usage significantly. * fts: Don't index inline base64 encoded content in FTS indexes using the generic tokenizer. This reduces the FTS index sizes by removing input that is very unlikely to be searched for. See https://doc.dovecot.org/configuration_manual/fts/tokenization for details on how base64 is detected. Only applies when using libfts. * lmtp: Session IDs are now preserved through proxied connections, so LMTP sessions can be tracked. This slightly changes the LMTP session ID format by appending ":Tn" (transaction), ":Pn" (proxy connection) and ":Rn" (recipient) counters after the session ID prefix. + Events now have "reason_code" field, which can provide a list of reasons why the event is happening. See https://doc.dovecot.org/admin_manual/event_reasons/ + New events are added. See https://doc.dovecot.org/admin_manual/list_of_events/ + fts: Added fts_header_excludes and fts_header_includes settings to specify which headers to index. See https://doc.dovecot.org/settings/plugin/fts-plugin#plugin-fts-setting-fts-h… for configuration details. + fts: Initialize the textcat language detection library only once per process. This can reduce CPU usage if fts_languages setting has multiple languages listed and service indexer-worker { service_count } isn't 1. Only applies when using libfts. + lib-storage: Reduced CPU usage significantly for some operations that accessed lots of emails (e.g. fetching all flags in a folder, SORT, ...) + lib: DOVECOT_PREREQ() - Add micro version which enables compiling external plugins against different versions of Dovecot. + lmtp: Added new lmtp_verbose_replies setting that makes errors sent to the LMTP client much more verbose with details about why exactly backend proxy connections or commands are failing. + submission: Support implicit SASL EXTERNAL with submission_client_workarounds=implicit-auth-external. This allows automatically logging in when SSL client certificate is present. - *-login: Statistics were disabled if stats process connection was lost. - auth: Authentication master user login fails with SCRAM-* SASL mechanisms. - auth: With auth_cache_verify_password_with_worker=yes, passdb extra fields in the auth cache got lost. - doveadm: Fixed crash if zlib_save_level setting was specified, but zlib_save was unset. v2.3.15 regression. - doveadm: Proxying can panic when flushing print output. v2.3.17 regression. Fixes: Panic: file ioloop.c: line 865 (io_loop_destroy): assertion failed: (ioloop == current_ioloop) - doveadm: stats add --group-by parameter didn't work. - fts: Using email-address fts tokenizer could result in excessive memory usage with garbage email input. This could cause the indexer-worker processes to fail due to reaching the VSZ memory size limit. Only applies when using libfts. - imap: A SEARCH command timing out while fts returns indexes may timeout returning "NO [SERVERBUG]", while it should return "NO [INUSE]" instead. - imap: LIST-EXTENDED doesn't return STATUS for all folders. Sending LIST .. RETURN (SUBSCRIBED STATUS (...)) did not return STATUS for folders that are not subscribed when they have a child folder that is subscribed as mandated by IMAP RFCs. - imapc: Mailbox vsize calculation crashed with Panic: file index-mailbox-size.c: line 344 (index_mailbox_vsize_hdr_add_missing): assertion failed: (mails_left > 0) - indexer: If indexer-worker crashes, the request it was processing gets stuck in the indexer process. This stops indexing for the folder until indexer process is restarted. v2.3.14 regression. - indexer: Process was slowly leaking memory for each indexing request. - lib-event: Unnamed events were wrongly filtered out for event/metric filters like "event=abc OR something_independent_of_event_name". - lib-index: 64-bit big endian CPUs handle last_used field in dovecot.index.cache wrong. - lib-ssl-iostream: Fix buggy OpenSSL error handling without assert-crashing. If there is no error available, log it as an error instead of crashing. The previous fix for this in v2.3.11 was incomplete. Fixes Panic: file istream-openssl.c: line 51 (i_stream_ssl_read_real): assertion failed: (errno != 0) - lmtp: Out-of-memory issues can happen when proxying large messages to LMTP backend servers that accept the message data too slow. - master: HAProxy header parsing has read buffer overflow if provided header size is invalid. This happens only if inet_listener { haproxy=yes } is configured and only if the remote IP address is in haproxy_trusted_networks. - old_stats: Plugin kept increasing memory usage, which became noticeable with long-running imap sessions. - stats: Dynamically adding same metric multiple times causes multiple stats. - submission-login: Authentication does not accept OAUTH2 token (or other very long credentials) because it considers the line to be too long. - submission-login: Process can crash if HELO is pipelined with an invalid domain. - submission-proxy: Don't use SASL-IR if it would make the AUTH command line longer than 512 bytes. - submission: Service would crash if relay server authentication failed. - virtual: FTS search in a virtual folder could crash if there are duplicate mailbox GUIDs. This mainly happened when user had both INBOX and INBOX/INBOX folders and the namespace prefix was INBOX/. Fixes Panic: file hash.c: line 252 (hash_table_insert_node): assertion failed: (opcode == HASH_TABLE_OP_UPDATE) - virtual: If mailbox opening fails, the backend mailbox is leaked and process crashes when client disconnects. Fixes Panic: file mail-user.c: line 232 (mail_user_deinit): assertion failed: ((*user)->refcount == 1) - virtual: Searching headers in virtual folders didn't always use full-text search indexes, if fts_enforced=no or body.

1 0

Pigeonhole v0.5.17.1 Released
by Aki Tuomi 07 Dec '21

07 Dec '21

We are happy to announce 0.5.17.1 patch release of Pigeonhole. This contains some fixes for issues found after 0.5.17 release. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.17.1… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.17.1… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Aki Tuomi Open-Xchange oy --- - managesieve: Dovecot failed to start if ssl_ca was too large. - lib-sieve-tool: Binaries failed to run if ssl_ca was too large.

1 0

Dovecot v2.3.17.1 Released
by Aki Tuomi 07 Dec '21

07 Dec '21

We are happy to announce 2.3.17.1 patch release of Dovecot. This contains some fixes for issues found after 2.3.17 release. https://dovecot.org/releases/2.3/dovecot-2.3.17.1.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.17.1.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Aki Tuomi Open-Xchange oy -- - dsync: Add back accidentically removed parameters. - lib-ssl-iostream: Fix assert-crash when OpenSSL returned syscall error without errno. - master: Dovecot failed to start if ssl_ca was too large.

1 0

Pigeonhole v0.5.17 released
by Aki Tuomi 28 Oct '21

28 Oct '21

We are pleased to release first release candidate for v0.5.14. We have done changes to packaging so please give us any feedback on how it works. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.17.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.17.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Kind regards, Aki Tuomi Open-Xchange oy --- - duplicate: The Sieve duplicate test is prone to false negatives when the user receives many e-mails concurrently, meaning that duplicate deliveries can still occur. - fileinto: v2.3.16 regression: Sieve delivery crashes if mail is delivered to non-existing and existing folder. - imap-filter-sieve: v2.3.15 regression: The CPU limits on Sieve execution are too easily exceeded in IMAP context (the IMAPSieve and FILTER=SIEVE capabilities). Changed the default to unlimited CPU time for IMAP context, since similar excessive resource usage can be caused by other means as well. The CPU limits on Sieve scripts executed at LDA/LMTP delivery are still enforced by default. - redirect: The Sieve redirect action has protections against users triggering mail loops. Unfortunately, the detection of a redirect mail loop sometimes causes the message to get lost if no other Sieve action is applied that delivers the message somewhere else. - redirect: v2.3.16 regression: With certain Sieve scripts if redirect fails due to temporary failure, the lmtp process may crash after the delivery. Fixes: Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)->refcount == 1).

1 1