[ubuntu/jammy-security] dovecot 1:2.3.16+dfsg1-3ubuntu2.4 (Accepted)

[Marc Deslauriers]

dovecot (1:2.3.16+dfsg1-3ubuntu2.4) jammy-security; urgency=medium

  * SECURITY UPDATE: Having a large number of address headers (From, To,
    Cc, Bcc, etc.) becomes excessively CPU intensive
    - debian/patches/CVE-2024-23184-1.patch: fix dllist2 test name in
      src/lib/test-llist.c.
    - debian/patches/CVE-2024-23184-2.patch: add DLLIST2_JOIN() in
      src/lib/llist.h, src/lib/test-llist.c.
    - debian/patches/CVE-2024-23184-3.patch: use test_assert_idx() where
      possible in src/lib-imap/test-imap-envelope.c.
    - debian/patches/CVE-2024-23184-4.patch: change message_address to be
      doubly linked list in src/lib-imap/imap-envelope.c,
      src/lib-mail/message-address.c, src/lib-mail/message-address.h,
      src/lib-mail/test-message-address.c.
    - debian/patches/CVE-2024-23184-5.patch: add
      message_address_parse_full() and struct message_address_list in
      src/lib-mail/message-address.c, src/lib-mail/message-address.h,
      src/lib-mail/test-message-address.c.
    - debian/patches/CVE-2024-23184-6.patch: optimize parsing large number
      of address headers in src/lib-imap/imap-envelope.c,
      src/lib-mail/message-part-data.c, src/lib-mail/message-part-data.h,
      src/lib-storage/index/index-search-mime.c.
    - CVE-2024-23184
  * SECURITY UPDATE: Very large headers can cause resource exhaustion when
    parsing message
    - debian/patches/CVE-2024-23185-1.patch: limit header block to 10MB by
      default in src/lib-mail/message-header-parser.c,
      src/lib-mail/message-header-parser.h,
      src/lib-mail/test-message-header-parser.c.
    - debian/patches/CVE-2024-23185-2.patch: limit headers total count to
      50MB by default in src/lib-mail/message-parser-private.h,
      src/lib-mail/message-parser.c, src/lib-mail/message-parser.h,
      src/lib-mail/test-message-parser.c.
    - CVE-2024-23185
  * Note: This package does _not_ contain the changes from
    1:2.3.16+dfsg1-3ubuntu2.3 in jammy-proposed.

dovecot (1:2.3.16+dfsg1-3ubuntu2.2) jammy; urgency=medium

  * Backport fix + refactoring for handling ssl settings
    (LP: #1991564)
    - d/p/split-master_service_ssl_settings_to_iostream_set-to-client-server-functions.patch
    - d/p/split-off-master_service_ssl_server_settings.patch
    - d/p/remove-unused-master_service_is_ssl_module_loaded.patch
    - d/p/use-ssl-server-settings-only-when-necessary.patch
    - d/p/remove-unnecessary-master_service_flag_use_ssl_settings.patch

Date: 2024-09-11 13:08:17.928424+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/dovecot/1:2.3.16+dfsg1-3ubuntu2.4
-------------- next part --------------
Sorry, changesfile not available.