[ubuntu/jammy-updates] dovecot 1:2.3.16+dfsg1-3ubuntu2.4 (Accepted)

[Ubuntu Archive Robot]

dovecot (1:2.3.16+dfsg1-3ubuntu2.4) jammy-security; urgency=medium

  * SECURITY UPDATE: Having a large number of address headers (From, To,
    Cc, Bcc, etc.) becomes excessively CPU intensive
    - debian/patches/CVE-2024-23184-1.patch: fix dllist2 test name in
      src/lib/test-llist.c.
    - debian/patches/CVE-2024-23184-2.patch: add DLLIST2_JOIN() in
      src/lib/llist.h, src/lib/test-llist.c.
    - debian/patches/CVE-2024-23184-3.patch: use test_assert_idx() where
      possible in src/lib-imap/test-imap-envelope.c.
    - debian/patches/CVE-2024-23184-4.patch: change message_address to be
      doubly linked list in src/lib-imap/imap-envelope.c,
      src/lib-mail/message-address.c, src/lib-mail/message-address.h,
      src/lib-mail/test-message-address.c.
    - debian/patches/CVE-2024-23184-5.patch: add
      message_address_parse_full() and struct message_address_list in
      src/lib-mail/message-address.c, src/lib-mail/message-address.h,
      src/lib-mail/test-message-address.c.
    - debian/patches/CVE-2024-23184-6.patch: optimize parsing large number
      of address headers in src/lib-imap/imap-envelope.c,
      src/lib-mail/message-part-data.c, src/lib-mail/message-part-data.h,
      src/lib-storage/index/index-search-mime.c.
    - CVE-2024-23184
  * SECURITY UPDATE: Very large headers can cause resource exhaustion when
    parsing message
    - debian/patches/CVE-2024-23185-1.patch: limit header block to 10MB by
      default in src/lib-mail/message-header-parser.c,
      src/lib-mail/message-header-parser.h,
      src/lib-mail/test-message-header-parser.c.
    - debian/patches/CVE-2024-23185-2.patch: limit headers total count to
      50MB by default in src/lib-mail/message-parser-private.h,
      src/lib-mail/message-parser.c, src/lib-mail/message-parser.h,
      src/lib-mail/test-message-parser.c.
    - CVE-2024-23185
  * Note: This package does _not_ contain the changes from
    1:2.3.16+dfsg1-3ubuntu2.3 in jammy-proposed.

Date: 2024-09-11 13:08:17.928424+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
https://launchpad.net/ubuntu/+source/dovecot/1:2.3.16+dfsg1-3ubuntu2.4
-------------- next part --------------
Sorry, changesfile not available.