[ol8_appstream] dovecot-1:2.2.36-5.el8_0.1.x86_64

Dovecot is an IMAP server for Linux/UNIX-like systems, written with security
primarily in mind.  It also contains a small POP3 server.  It supports mail
in either of maildir or mbox formats.

The SQL drivers and authentication plug-ins are in their subpackages.

Changelog (Show File list) (Show related packages)

• Fri Aug 30 2019 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-5.1

  - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte
    when scanning data in quoted strings, leading to out of bounds heap
    memory writes (#1741788)

• Tue Oct 16 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-5

  - make key not that bigger (#1618714)

• Tue Oct 16 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-4

  - generated key was too small (#1618714)

• Wed Sep 19 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-3

  - fix global ACL directory configuration search path (#1630383)
  - update first/last_valid_gid range patch (#1630410)

• Mon Jul 30 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-2

  - fix defaut permissions of gost run files

• Thu Jun 28 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-1

  - dovecot updated to 2.2.36, pigeonhole to 0.4.24

• Thu May 24 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.35-3

  - disable tcp_wrappers as it's not available in rhel8

• Thu Apr 19 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.35-2

  - include crypt.h explicitely

• Wed Mar 21 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.35-1

  - dovecot updated to 2.2.35, pigeonhole updated to 0.4.23

• Thu Mar 01 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.34-1

  - dovecot updated to 2.2.34, pigeonhole updated to 0.4.22
  - fixes CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be reached
    and the process restarted. This happens only if Dovecot config has
    local_name { } or local { } configuration blocks and attacker uses
    randomly generated SNI servernames.
  - fixes CVE-2017-14461: Parsing invalid email addresses may cause a crash or
    leak memory contents to attacker. For example, these memory contents
    might contain parts of an email from another user if the same imap
    process is reused for multiple users.
  - fixes CVE-2017-15132: Aborted SASL authentication leaks memory in login
    process.