%global __provides_exclude_from %{_docdir}

%global __requires_exclude_from %{_docdir}

Summary: Secure imap and pop3 server

Name: dovecot

Epoch: 1

Version: 2.3.16

%global prever %{nil}

Release: 3%{?dist}

#dovecot itself is MIT, a few sources are PD, pigeonhole is LGPLv2

License: MIT and LGPLv2

Group: System Environment/Daemons

URL: http://www.dovecot.org/

Source: http://www.dovecot.org/releases/2.3/%{name}-%{version}%{?prever}.tar.gz

Source1: dovecot.init

Source2: dovecot.pam

%global pigeonholever 0.5.16

Source8: http://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-%{pigeonholever}.tar.gz

Source9: dovecot.sysconfig

Source10: dovecot.tmpfilesd

#our own

Source14: dovecot.conf.5

# 3x Fedora/RHEL specific

Patch1: dovecot-2.0-defaultconfig.patch

Patch2: dovecot-1.0.beta2-mkcert-permissions.patch

Patch3: dovecot-1.0.rc7-mkcert-paths.patch

#wait for network

Patch6: dovecot-2.1.10-waitonline.patch

Patch8: dovecot-2.2.20-initbysystemd.patch

Patch9: dovecot-2.2.22-systemd_w_protectsystem.patch

# sent upstream, rhbz#1630380

Patch11: dovecot-2.2.36-aclfix.patch

Patch13: dovecot-2.2.36-bigkey.patch

# do not use own implementation of HMAC, use OpenSSL for certification purposes

# not sent upstream as proper fix would use dovecot's lib-dcrypt but it introduces

# hard to break circular dependency between lib and lib-dcrypt

Patch14: dovecot-2.3.6-opensslhmac.patch

# from upstream, for dovecot < 2.3.17, s390x FTBFS fix

Patch15: dovecot-2.3.16-ftbfsbigend.patch

Patch16: dovecot-2.3.16-keeplzma.patch

# from upstream, for <= 2.3.19.1, rhbz#2106232

Patch17: dovecot-2.3.19.1-7bad6a24.patch

Source15: prestartscript

BuildRequires: openssl-devel, pam-devel, zlib-devel, bzip2-devel, libcap-devel

BuildRequires: libtool, autoconf, automake, pkgconfig

BuildRequires: sqlite-devel

BuildRequires: postgresql-devel

#BuildRequires: libpq-devel

BuildRequires: mariadb-connector-c-devel

#BuildRequires: libxcrypt-devel

BuildRequires: openldap-devel

BuildRequires: krb5-devel

BuildRequires: quota-devel

BuildRequires: xz-devel

BuildRequires: lz4-devel

BuildRequires: multilib-rpm-config

#BuildRequires: libsodium-devel

#BuildRequires: libexttextcat-devel

#BuildRequires: libstemmer-devel

# gettext-devel is needed for running autoconf because of the

# presence of AM_ICONV

BuildRequires: gettext-devel

# Explicit Runtime Requirements for executalbe

Requires: openssl >= 0.9.7f-4

# Package includes an initscript service file, needs to require initscripts package

Requires(pre): shadow-utils

%if %{?fedora}0 > 140 || %{?rhel}0 > 60

Requires: systemd

Requires(post): systemd-units

Requires(preun): systemd-units

Requires(postun): systemd-units

%else

Requires: initscripts

Requires(post): chkconfig

Requires(preun): chkconfig initscripts

Requires(postun): initscripts

%endif

%if %{?fedora}0 > 150 || %{?rhel}0 >60

#clucene in fedora <=15 and rhel<=6 is too old

BuildRequires: clucene-core-devel

%endif

%global ssldir %{_sysconfdir}/pki/%{name}

%if %{?fedora}00%{?rhel} < 6

%global _initddir %{_initrddir}

BuildRequires: curl-devel expat-devel

%else

BuildRequires: libcurl-devel expat-devel

%endif

%global restart_flag /var/run/%{name}/%{name}-restart-after-rpm-install

%description

Dovecot is an IMAP server for Linux/UNIX-like systems, written with security 

primarily in mind.  It also contains a small POP3 server.  It supports mail 

in either of maildir or mbox formats.

The SQL drivers and authentication plug-ins are in their subpackages.

%package pigeonhole

Requires: %{name} = %{epoch}:%{version}-%{release}

Summary: Sieve and managesieve plug-in for dovecot

Group: System Environment/Daemons

License: MIT and LGPLv2

%description pigeonhole

This package provides sieve and managesieve plug-in for dovecot LDA.

%package pgsql

Requires: %{name} = %{epoch}:%{version}-%{release}

Summary: Postgres SQL back end for dovecot

Group: System Environment/Daemons

%description pgsql

This package provides the Postgres SQL back end for dovecot-auth etc.

%package mysql

Requires: %{name} = %{epoch}:%{version}-%{release}

Summary: MySQL back end for dovecot

Group: System Environment/Daemons

%description mysql

This package provides the MySQL back end for dovecot-auth etc.

%package devel

Requires: %{name} = %{epoch}:%{version}-%{release}

Summary: Development files for dovecot

Group: Development/Libraries

%description devel

This package provides the development files for dovecot.

%prep

%setup -q -n %{name}-%{version}%{?prever} -a 8

%patch1 -p1 -b .default-settings

%patch2 -p1 -b .mkcert-permissions

%patch3 -p1 -b .mkcert-paths

%patch6 -p1 -b .waitonline

%patch8 -p1 -b .initbysystemd

%patch9 -p1 -b .systemd_w_protectsystem

%patch11 -p1 -b .aclfix

%patch13 -p1 -b .bigkey

%patch14 -p1 -b .opensslhmac

%patch15 -p1 -b .ftbfsbigend

%patch16 -p1 -b .keeplzma

%patch17 -p1 -b .7bad6a24

pushd dovecot-2*3-pigeonhole-%{pigeonholever}

popd

sed -i '/DEFAULT_INCLUDES *=/s|$| '"$(pkg-config --cflags libclucene-core)|" src/plugins/fts-lucene/Makefile.in

%build

#required for fdpass.c line 125,190: dereferencing type-punned pointer will break strict-aliasing rules

%global _hardened_build 1

export CFLAGS="%{__global_cflags} -fno-strict-aliasing -fstack-reuse=none"

export LDFLAGS="-Wl,-z,now -Wl,-z,relro %{?__global_ldflags}"

# el6 autoconf too old to regen; use packaged files (#1082384)

%if %{?fedora}00%{?rhel} > 6

mkdir -p m4

autoreconf -I . -fiv #required for aarch64 support

%endif

%configure                       \

    INSTALL_DATA="install -c -p -m644" \

    --with-rundir=%{_rundir}/%{name}   \

    --with-systemd               \

    --docdir=%{_docdir}/%{name}  \

    --disable-static             \

    --disable-rpath              \

    --with-nss                   \

    --with-shadow                \

    --with-pam                   \

    --with-gssapi=plugin         \

    --with-ldap=plugin           \

    --with-sql=plugin            \

    --with-pgsql                 \

    --with-mysql                 \

    --with-sqlite                \

    --with-zlib                  \

    --with-libcap                \

    --with-lucene                \

    --with-ssl=openssl           \

    --with-ssldir=%{ssldir}      \

    --with-solr                  \

    --with-systemdsystemunitdir=%{_unitdir}  \

    --with-docs

sed -i 's|/etc/ssl|/etc/pki/dovecot|' doc/mkcert.sh doc/example-config/conf.d/10-ssl.conf

make %{?_smp_mflags}

#pigeonhole

pushd dovecot-2*3-pigeonhole-%{pigeonholever}

# required for snapshot

[ -f configure ] || autoreconf -fiv

[ -f ChangeLog ] || echo "Pigeonhole ChangeLog is not available, yet" >ChangeLog

%configure                             \

    INSTALL_DATA="install -c -p -m644" \

    --disable-static                   \

    --with-dovecot=../                 \

    --without-unfinished-features

make %{?_smp_mflags}

popd

%install

rm -rf $RPM_BUILD_ROOT

make install DESTDIR=$RPM_BUILD_ROOT

# move doc dir back to build dir so doc macro in files section can use it

mv $RPM_BUILD_ROOT/%{_docdir}/%{name} %{_builddir}/%{name}-%{version}%{?prever}/docinstall

# fix multilib issues

%multilib_fix_c_header --file %{_includedir}/dovecot/config.h

pushd dovecot-2*3-pigeonhole-%{pigeonholever}

make install DESTDIR=$RPM_BUILD_ROOT

mv $RPM_BUILD_ROOT/%{_docdir}/%{name} $RPM_BUILD_ROOT/%{_docdir}/%{name}-pigeonhole

install -m 644 AUTHORS ChangeLog COPYING COPYING.LGPL INSTALL NEWS README $RPM_BUILD_ROOT/%{_docdir}/%{name}-pigeonhole

popd

%if %{?fedora}00%{?rhel} < 6

sed -i 's|password-auth|system-auth|' %{SOURCE2}

%endif

install -p -D -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/dovecot

#install man pages

install -p -D -m 644 %{SOURCE14} $RPM_BUILD_ROOT%{_mandir}/man5/dovecot.conf.5

#install waitonline script

install -p -D -m 755 %{SOURCE15} $RPM_BUILD_ROOT%{_libexecdir}/dovecot/prestartscript

# generate ghost .pem files

mkdir -p $RPM_BUILD_ROOT%{ssldir}/certs

mkdir -p $RPM_BUILD_ROOT%{ssldir}/private

touch $RPM_BUILD_ROOT%{ssldir}/certs/dovecot.pem

chmod 600 $RPM_BUILD_ROOT%{ssldir}/certs/dovecot.pem

touch $RPM_BUILD_ROOT%{ssldir}/private/dovecot.pem

chmod 600 $RPM_BUILD_ROOT%{ssldir}/private/dovecot.pem

%if %{?fedora}0 > 140 || %{?rhel}0 > 60

install -p -D -m 644 %{SOURCE10} $RPM_BUILD_ROOT%{_tmpfilesdir}/dovecot.conf

%else

install -p -D -m 755 %{SOURCE1} $RPM_BUILD_ROOT%{_initddir}/dovecot

install -p -D -m 600 %{SOURCE9} $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/dovecot

%endif

mkdir -p $RPM_BUILD_ROOT/var/run/dovecot/{login,empty,token-login}

# Install dovecot configuration and dovecot-openssl.cnf

mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/dovecot/conf.d

install -p -m 644 docinstall/example-config/dovecot.conf $RPM_BUILD_ROOT%{_sysconfdir}/dovecot

install -p -m 644 docinstall/example-config/conf.d/*.conf $RPM_BUILD_ROOT%{_sysconfdir}/dovecot/conf.d

install -p -m 644 $RPM_BUILD_ROOT/%{_docdir}/%{name}-pigeonhole/example-config/conf.d/*.conf $RPM_BUILD_ROOT%{_sysconfdir}/dovecot/conf.d

install -p -m 644 docinstall/example-config/conf.d/*.conf.ext $RPM_BUILD_ROOT%{_sysconfdir}/dovecot/conf.d

install -p -m 644 $RPM_BUILD_ROOT/%{_docdir}/%{name}-pigeonhole/example-config/conf.d/*.conf.ext $RPM_BUILD_ROOT%{_sysconfdir}/dovecot/conf.d ||:

install -p -m 644 doc/dovecot-openssl.cnf $RPM_BUILD_ROOT%{ssldir}/dovecot-openssl.cnf

install -p -m755 doc/mkcert.sh $RPM_BUILD_ROOT%{_libexecdir}/%{name}/mkcert.sh

mkdir -p $RPM_BUILD_ROOT/var/lib/dovecot

#remove the libtool archives

find $RPM_BUILD_ROOT%{_libdir}/%{name}/ -name '*.la' | xargs rm -f

#remove what we don't want

rm -f $RPM_BUILD_ROOT%{_sysconfdir}/dovecot/README

pushd docinstall

rm -f securecoding.txt thread-refs.txt

popd

%pre

#dovecot uid and gid are reserved, see /usr/share/doc/setup-*/uidgid 

getent group dovecot >/dev/null || groupadd -r --gid 97 dovecot

getent passwd dovecot >/dev/null || \

useradd -r --uid 97 -g dovecot -d /usr/libexec/dovecot -s /sbin/nologin -c "Dovecot IMAP server" dovecot

getent group dovenull >/dev/null || groupadd -r dovenull

getent passwd dovenull >/dev/null || \

useradd -r -g dovenull -d /usr/libexec/dovecot -s /sbin/nologin -c "Dovecot's unauthorized user" dovenull

# do not let dovecot run during upgrade rhbz#134325

if [ "$1" = "2" ]; then

  rm -f %restart_flag

%if %{?fedora}0 > 140 || %{?rhel}0 > 60

  /bin/systemctl is-active %{name}.service >/dev/null 2>&1 && touch %restart_flag ||:

  /bin/systemctl stop %{name}.service >/dev/null 2>&1

%else

  /sbin/service %{name} status >/dev/null 2>&1 && touch %restart_flag ||:

  /sbin/service %{name} stop >/dev/null 2>&1

%endif

fi

%post

if [ $1 -eq 1 ]

then

%if %{?fedora}0 > 140 || %{?rhel}0 > 60

  %systemd_post dovecot.service

%else

  /sbin/chkconfig --add %{name}

%endif

fi

install -d -m 0755 -g dovecot -d /var/run/dovecot

install -d -m 0755 -d /var/run/dovecot/empty

install -d -m 0750 -g dovenull -d /var/run/dovecot/login

install -d -m 0750 -g dovenull -d /var/run/dovecot/token-login

[ -x /sbin/restorecon ] && /sbin/restorecon -R /var/run/dovecot ||:

%preun

if [ $1 = 0 ]; then

%if %{?fedora}0 > 140 || %{?rhel}0 > 60

        /bin/systemctl disable dovecot.service dovecot.socket >/dev/null 2>&1 || :

        /bin/systemctl stop dovecot.service dovecot.socket >/dev/null 2>&1 || :

%else

    /sbin/service %{name} stop > /dev/null 2>&1

    /sbin/chkconfig --del %{name}

%endif

    rm -rf /var/run/dovecot

fi

%postun

%if %{?fedora}0 > 140 || %{?rhel}0 > 60

/bin/systemctl daemon-reload >/dev/null 2>&1 || :

%endif

if [ "$1" -ge "1" -a -e %restart_flag ]; then

%if %{?fedora}0 > 140 || %{?rhel}0 > 60

    /bin/systemctl start dovecot.service >/dev/null 2>&1 || :

%else

    /sbin/service %{name} start >/dev/null 2>&1 || :

%endif

rm -f %restart_flag

fi

%posttrans

# dovecot should be started again in %%postun, but it's not executed on reinstall

# if it was already started, restart_flag won't be here, so it's ok to test it again

if [ -e %restart_flag ]; then

%if %{?fedora}0 > 140 || %{?rhel}0 > 60

    /bin/systemctl start dovecot.service >/dev/null 2>&1 || :

%else

    /sbin/service %{name} start >/dev/null 2>&1 || :

%endif

rm -f %restart_flag

fi

%check

make check

cd dovecot-2*3-pigeonhole-%{pigeonholever}

make check

%files

%doc docinstall/* AUTHORS ChangeLog COPYING COPYING.LGPL COPYING.MIT NEWS README

%{_sbindir}/dovecot

%{_bindir}/doveadm

%{_bindir}/doveconf

%{_bindir}/dsync

%{_bindir}/dovecot-sysreport

%if %{?fedora}0 > 140 || %{?rhel}0 > 60

%_tmpfilesdir/dovecot.conf

%{_unitdir}/dovecot.service

%{_unitdir}/dovecot-init.service

%{_unitdir}/dovecot.socket

%else

%{_initddir}/dovecot

%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/dovecot

%endif

%dir %{_sysconfdir}/dovecot

%dir %{_sysconfdir}/dovecot/conf.d

%config(noreplace) %{_sysconfdir}/dovecot/dovecot.conf

#list all so we'll be noticed if upstream changes anything

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/10-auth.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/10-director.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/10-logging.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/10-mail.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/10-master.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/10-metrics.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/10-ssl.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/15-lda.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/15-mailboxes.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/20-imap.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/20-lmtp.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/20-pop3.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/20-submission.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/90-acl.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/90-quota.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/90-plugin.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/auth-checkpassword.conf.ext

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/auth-deny.conf.ext

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/auth-dict.conf.ext

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/auth-ldap.conf.ext

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/auth-master.conf.ext

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/auth-passwdfile.conf.ext

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/auth-sql.conf.ext

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/auth-static.conf.ext

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/auth-system.conf.ext

%config(noreplace) %{_sysconfdir}/pam.d/dovecot

%config(noreplace) %{ssldir}/dovecot-openssl.cnf

%dir %{ssldir}

%dir %{ssldir}/certs

%dir %{ssldir}/private

%attr(0600,root,root) %ghost %config(missingok,noreplace) %verify(not md5 size mtime) %{ssldir}/certs/dovecot.pem

%attr(0600,root,root) %ghost %config(missingok,noreplace) %verify(not md5 size mtime) %{ssldir}/private/dovecot.pem

%dir %{_libdir}/dovecot

%dir %{_libdir}/dovecot/auth

%dir %{_libdir}/dovecot/dict

%{_libdir}/dovecot/doveadm

%exclude %{_libdir}/dovecot/doveadm/*sieve*

%{_libdir}/dovecot/*.so.*

#these (*.so files) are plugins, not devel files

%{_libdir}/dovecot/*_plugin.so

%exclude %{_libdir}/dovecot/*_sieve_plugin.so

%{_libdir}/dovecot/auth/lib20_auth_var_expand_crypt.so

%{_libdir}/dovecot/auth/libauthdb_imap.so

%{_libdir}/dovecot/auth/libauthdb_ldap.so

%{_libdir}/dovecot/auth/libmech_gssapi.so

%{_libdir}/dovecot/auth/libdriver_sqlite.so

%{_libdir}/dovecot/dict/libdriver_sqlite.so

%{_libdir}/dovecot/dict/libdict_ldap.so

%{_libdir}/dovecot/libdriver_sqlite.so

%{_libdir}/dovecot/libssl_iostream_openssl.so

%{_libdir}/dovecot/libfs_compress.so

%{_libdir}/dovecot/libfs_crypt.so

%{_libdir}/dovecot/libfs_mail_crypt.so

%{_libdir}/dovecot/libdcrypt_openssl.so

%{_libdir}/dovecot/lib20_var_expand_crypt.so

%{_libdir}/dovecot/old-stats/libold_stats_mail.so

%{_libdir}/dovecot/old-stats/libstats_auth.so

%dir %{_libdir}/dovecot/settings

%{_libexecdir}/%{name}

%exclude %{_libexecdir}/%{name}/managesieve*

%dir %attr(0755,root,dovecot) %ghost /var/run/dovecot

%attr(0750,root,dovenull) %ghost /var/run/dovecot/login

%attr(0750,root,dovenull) %ghost /var/run/dovecot/token-login

%attr(0755,root,root) %ghost /var/run/dovecot/empty

%attr(0750,dovecot,dovecot) /var/lib/dovecot

%{_datadir}/%{name}

%{_mandir}/man1/deliver.1*

%{_mandir}/man1/doveadm*.1*

%{_mandir}/man1/doveconf.1*

%{_mandir}/man1/dovecot*.1*

%{_mandir}/man1/dsync.1*

%{_mandir}/man5/dovecot.conf.5*

%{_mandir}/man7/doveadm-search-query.7*

%files devel

%{_includedir}/dovecot

%{_datadir}/aclocal/dovecot*.m4

%{_libdir}/dovecot/libdovecot*.so

%{_libdir}/dovecot/dovecot-config

%files pigeonhole

%{_bindir}/sieve-dump

%{_bindir}/sieve-filter

%{_bindir}/sieve-test

%{_bindir}/sievec

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/20-managesieve.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/90-sieve.conf

%config(noreplace) %{_sysconfdir}/dovecot/conf.d/90-sieve-extprograms.conf

%{_docdir}/%{name}-pigeonhole

%{_libexecdir}/%{name}/managesieve

%{_libexecdir}/%{name}/managesieve-login

%{_libdir}/dovecot/doveadm/*sieve*

%{_libdir}/dovecot/*_sieve_plugin.so

%{_libdir}/dovecot/settings/libmanagesieve_*.so

%{_libdir}/dovecot/settings/libpigeonhole_*.so

%{_libdir}/dovecot/sieve/

%{_mandir}/man1/sieve-dump.1*

%{_mandir}/man1/sieve-filter.1*

%{_mandir}/man1/sieve-test.1*

%{_mandir}/man1/sievec.1*

%{_mandir}/man1/sieved.1*

%{_mandir}/man7/pigeonhole.7*

%files mysql

%{_libdir}/%{name}/libdriver_mysql.so

%{_libdir}/%{name}/auth/libdriver_mysql.so

%{_libdir}/%{name}/dict/libdriver_mysql.so

%files pgsql

%{_libdir}/%{name}/libdriver_pgsql.so

%{_libdir}/%{name}/auth/libdriver_pgsql.so

%{_libdir}/%{name}/dict/libdriver_pgsql.so

%changelog

* Tue Jul 19 2022 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-3

- fix possible privilege escalation when similar master and non-master passdbs are used (#2106231)

* Wed Dec 08 2021 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-2

- do not disable xz/lzma for now despite being deprecated

* Wed Dec 08 2021 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-1

- dovecot updated to 2.3.16, pigeonhole to 0.5.16

- fix CVE-2021-33515 plaintext commands injection (#1980014)

* Wed Feb 03 2021 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-9

- fix CVE-2020-24386 IMAP hibernation function allows mail access (#1913534)

* Tue Jan 12 2021 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-8

- fix CVE-2020-25275 denial of service via mail MIME parsing (#1914019)

* Thu Jan 07 2021 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-7

- change run directory from /var/run to /run (#1805947)

* Wed Dec 02 2020 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-6

- fix mail storage block count parsing (#1894418)

- MIME parser crashed when boundaries were wrong (#1888111)

* Mon Nov 02 2020 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-5

- multilib compatibility (#1853137)

* Fri Aug 07 2020 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-4

- fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1866756)

- fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1866761)

- fix CVE-2020-12674 crash due to assert in RPA implementation (#1866768)

* Mon Jun 01 2020 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-3

- fix CVE-2020-10957 dovecot: malformed NOOP commands leads to DoS (#1840354)

- fix CVE-2020-10958 dovecot: command followed by sufficient number of newlines

  leads to use-after-free (#1840357)

- fix CVE-2020-10967 dovecot: sending mail with empty quoted localpart

  leads to DoS (#1840356)

* Thu Jan 09 2020 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-2

- fix default attributes for ghost files

* Tue Nov 19 2019 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-1

- dovecot updated to 2.3.8 with pigeonhole updated to 0.5.8 (#1653117)

* Thu Aug 29 2019 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-10

- fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte

  when scanning data in quoted strings, leading to out of bounds heap

  memory writes (#1741788)

* Fri Aug 23 2019 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-9

- reset errno before iterating through users (#1630410)

* Mon Jun 17 2019 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-8

- fix CVE-2019-3814: improper certificate validation (#1674370)

* Fri Jun 14 2019 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-7

- do not print error message when restorecon is not present 

  during install (#1626395)

- change default config to use minimal UID = 1000 (#1630410)

* Mon Jun 10 2019 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-6

- use OpenSSl implementation of HMAC, disable CRAM-MD5 when FIPS is enabled (#1618749)

* Tue Oct 16 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-5

- make key not that bigger (#1618714)

* Tue Oct 16 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-4

- generated key was too small (#1618714)

* Wed Sep 19 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-3

- fix global ACL directory configuration search path (#1630383)

- update first/last_valid_gid range patch (#1630410)

* Mon Jul 30 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-2

- fix defaut permissions of gost run files

* Thu Jun 28 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-1

- dovecot updated to 2.2.36, pigeonhole to 0.4.24

* Thu May 24 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.35-3

- disable tcp_wrappers as it's not available in rhel8

* Thu Apr 19 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.35-2

- include crypt.h explicitely

* Wed Mar 21 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.35-1

- dovecot updated to 2.2.35, pigeonhole updated to 0.4.23

* Thu Mar 01 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.34-1

- dovecot updated to 2.2.34, pigeonhole updated to 0.4.22

- fixes CVE-2017-15130: TLS SNI config lookups may lead to excessive

  memory usage, causing imap-login/pop3-login VSZ limit to be reached

  and the process restarted. This happens only if Dovecot config has

  local_name { } or local { } configuration blocks and attacker uses

  randomly generated SNI servernames.

- fixes CVE-2017-14461: Parsing invalid email addresses may cause a crash or

  leak memory contents to attacker. For example, these memory contents

  might contain parts of an email from another user if the same imap

  process is reused for multiple users.

- fixes CVE-2017-15132: Aborted SASL authentication leaks memory in login

  process.

* Fri Feb 09 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 1:2.2.33.2-5

- Escape macros in %%changelog

* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1:2.2.33.2-4

- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

* Sat Jan 20 2018 Björn Esser <besser82@fedoraproject.org> - 1:2.2.33.2-3

- Rebuilt for switch to libxcrypt

* Mon Jan 08 2018 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.33.2-2

- remove tcp_wrappers on Fedora 28 and later (#1518761)

- use use mariadb-connector-c-devel instead of mysql-devel on Fedora 28 and later (#1493624)

* Tue Oct 24 2017 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.33.2-1

- dovecot updated to 2.2.33.2

- doveadm: Fix crash in proxying (or dsync replication) if remote is

  running older than v2.2.33

- auth: Fix memory leak in %%{ldap_dn}

- dict-sql: Fix data types to work correctly with Cassandra

* Wed Oct 18 2017 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.33.1-1

- dovecot updated to 2.2.33.1, pigeonhole updated to 

- Added %%{if}, see https://wiki2.dovecot.org/Variables#Conditionals

- sdbox: Mails were always opened when expunging, unless

  mail_attachment_fs was explicitly set to empty.

- lmtp/doveadm proxy: hostip passdb field was ignored, which caused

  unnecessary DNS lookups if host field wasn't an IP

- lmtp proxy: Fix crash when receiving unexpected reply in RCPT TO

- quota_clone: Update also when quota is unlimited (broken in v2.2.31)

- mbox, zlib: Fix assert-crash when accessing compressed mbox

- doveadm director kick -f parameter didn't work

- doveadm director flush <host> resulted flushing all hosts, if <host>

  wasn't an IP address.

- director: Various fixes to handling backend/director changes at

   abnormal times, especially while ring was unsynced.

- director: Use less CPU in imap-login processes when moving/kicking

  many users.

- lmtp: Session IDs were duplicated/confusing with multiple RCPT TOs

  when lmtp_rcpt_check_quota=yes

- LDA Sieve plugin: Fixed sequential execution of LDAP-based scripts. A

  missing LDAP-based script could cause the script sequence to exit earlier.

- sieve-filter: Removed the (now) duplicate utf8 to mutf7 mailbox name

  conversion. This caused problems with mailbox names containing UTF-8

  characters. 

* Mon Aug 28 2017 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.32-2

- pigeonhole updated to 0.4.20

- Made the retention period for redirect duplicate identifiers

  configurable. Changed the default retention period from 24 to 12 hours.

- sieve-filter: Fixed memory leak: forgot to clean up script binary at

  end of execution

- managesieve-login: Fixed handling of AUTHENTICATE command. A second

  authenticate command would be parsed wrong.

* Fri Aug 25 2017 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.32-1

- dovecot updated to 2.2.32

- Modseq tracking didn't always work correctly. This could have caused

  imap unhibernation to fail or IMAP QRESYNC/CONDSTORE extensions to

  not work perfectly.

- mdbox: "Inconsistency in map index" wasn't fixed automatically

- dict-ldap: %%variable values used in the LDAP filter weren't escaped.

- quota=count: quota_warning = -storage=.. was never executed (try #2).

- imapc: >= 32 kB mail bodies were supposed to be cached for subsequent

  FETCHes, but weren't.

- quota-status service didn't support recipient_delimiter

- acl: Don't access dovecot-acl-list files with acl_globals_only=yes

- mail_location: If INDEX dir is set, mailbox deletion deletes its

  childrens' indexes. 

- director: v2.2.31 caused rapid reconnection loops to directors

  that were down.

* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1:2.2.31-5

- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1:2.2.31-4

- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

* Tue Jul 11 2017 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.31-3

- enable tcpwrap support (#1450587)

* Tue Jul 04 2017 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.31-2

- revert commit breaking NOTIFY support

* Tue Jun 27 2017 Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.31-1

- dovecot updated to 2.2.31

- Various fixes to handling mailbox listing. Especially related to

  handling nonexistent autocreated/autosubscribed mailboxes and ACLs.

- Global ACL file was parsed as if it was local ACL file. This caused

  some of the ACL rule interactions to not work exactly as intended.

- Using mail_sort_max_read_count may have caused very high CPU usage.

- Message address parsing could have crashed on invalid input.

- imapc_features=fetch-headers wasn't always working correctly and

  caused the full header to be fetched.

- imapc: Various bugfixes related to connection failure handling.

- quota=count: quota_warning = -storage=.. was never executed