linux/meta-openembedded.git/meta-networking/recipes-support/dovecot, branch whinlatter

dovecot: mark CVE-2026-0394 patched

2026-04-24T15:43:20+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-0394 As identified[1] by Debian, the recipe version already contains the commits that fix this. Due to this mark it as patched. [1]: https://security-tracker.debian.org/tracker/CVE-2026-0394 Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

dovecot: patch CVE-2025-59031

2026-04-24T15:43:20+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-59031 Backport the patch that was identified[1] by Debian. [1]: https://security-tracker.debian.org/tracker/CVE-2025-59031 Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

dovecot: patch CVE-2025-30189

2026-01-06T12:37:48+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-30189 Pick the patches referenced by the advisory[1] from the Full Disclosure list. [1]: https://seclists.org/fulldisclosure/2025/Oct/29 Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

dovecot: Fix service start error

2025-10-31T15:55:36+00:00

1.Fix following dovecot.service starting error. dovecot[364]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 48: cert_file: open(/etc/dovecot/ssl-cert.pem) failed: No such file or directory systemd[1]: dovecot.service: Main process exited, code=exited, status=89/n/a systemd[1]: dovecot.service: Failed with result 'exit-code'. 2. There is no need to do "touch ${D}/etc/dovecot/dovecot.conf" as it was created by dovecot after dovecot was upgraded to 2.4.1-4. Signed-off-by: Liu Yiding Signed-off-by: Khem Raj

dovecot: ignore CVE-2016-4983 (again)

2025-10-14T06:47:40+00:00

I removed the CVE_STATUS setting for CVE-2016-4983 when this recipe was updated to 2.4.1-4 - but that was a mistake, the CVE database considers (incorrectly) even the latest version as vulnerable. Revert that mistake by adding back the correct CVE_STATUS to the recipe. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj

dovecot: upgrade 2.3.21.1 -> 2.4.1-4

2025-10-06T21:14:37+00:00

Remove obsolete CVE_STATUS variable: CVE-2016-4983 is marked for v2.3. Drop 0001-not-check-pandoc.patch because it became obsolete, pandoc is not used anymore. Drop 1ccd5b54a408d12fce0c94ab0bbaedbb5ef69830.patch, because it is included in this release. Add a backported patch to fix compiling with musl. Changelog: 2.4: https://github.com/dovecot/core/releases/tag/2.4.0 2.4.1: https://github.com/dovecot/core/releases/tag/2.4.1 Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj

dovecot: Upgrade to 2.3.21.1

2024-11-23T17:00:14+00:00

Fix build with icu-76.x while here Signed-off-by: Khem Raj

devecot: set dovecot.conf file mode with chmod

2024-06-28T18:22:06+00:00

The touch command doesn't support file mode setting. Set it with chmod. Signed-off-by: Yi Zhao Signed-off-by: Khem Raj

recipes: Start WORKDIR -> UNPACKDIR transition

2024-05-23T15:44:44+00:00

Replace references of WORKDIR with UNPACKDIR where it makes sense to do so in preparation for changing the default value of UNPACKDIR. Signed-off-by: Khem Raj

dovecot: upgrade 2.3.20 -> 2.3.21

2023-09-20T22:34:02+00:00

Changelog: ========== * lib-oauth2: Allow JWT tokens to be validated with missing typ field. + auth: Auth passdb and userdb reply can contain "event_=value" which will be added to login event and mail user event respectively. + lib-master: Set process title during various initialization stages to clearly describe what the process is waiting on. + lib-storage: The mail_temp_scan_interval is now fuzzed incrementing it by 0..30% based on username's hash to reduce the chance of load spikes. + lib-storage: The temp file scan has been moved from the open of the mailbox to the close, to reduce the latency perceived by users. + stats: If metric has fields specified, all these fields are exported as counters to prometheus exposition. - *-login: Processes might have crashed when a SSL connection disconnects uncleanly. - acl: When plugin was loaded \HasChildren and \HasNoChildren flags were calculated incorrectly for mailboxes containing '*' and '%' in their names. - auth: Crash occured if a connection to PostgreSQL database server failed during startup. - auth: Logins with invalid passwords (e.g. unknown scheme) in passdb were failing with "password mismatch" instead of "internal error". - auth: XOAUTH2 and OAUTHBEARER mechanisms were not giving out protocol specific error message on all errors. This especially broke OIDC discovery. - dbox: When last_temp_file_scan header wasn't set (especially after dsync migration), the next mailbox open always triggers the temp file scan. - dict-redis: A crash would occur on transaction rollback. - dsync: Infinite loop causing out of memory would occur when handling mailbox deletion from remote end and hierarchy separators would differ. - dsync: Incremental dsync failed for folder names ending with '%', unless BROKENCHAR was set. Also folder names with '%' elsewhere in them caused each incremental dsync to unnecessarily rename the folder to a temporary name and back. v2.3.19 regression. - imap-hibernate: If an IMAP client unhibernation timed out with "(version received)", the unhibernation could still have successfully finished later on and continued working normally. This was rather confusing, because imap-hibernate already logged that the client got disconnected. - imapc: Crashed when a folder mapped through the virtual plugin disappears from the storage. - imapc: EXPUNGE, EXISTS or FETCH replies from a server for a previously selected mailbox could have been processed as if they belonged to the new mailbox currently being selected. - lib-http: Dovecot HTTP server (doveadm, stats/openmetrics) may have disconnected HTTP clients before the response is fully sent. This happened only on busy servers where kernel's socket buffers were rather full. - lib-http: Fixed a potential crash on http-server if a client disconnected early. v2.3.18 regression. - lib-index: Index file corruption could have caused a crash. Fixes: Panic: file mail-transaction-log-view.c: line 165 (mail_transaction_log_view_set): assertion failed: (min_file_seq <= max_file_seq). - lib-index: Purging an existing >1GB cache file can crash. Now cache files still above 1GB after purging are removed. Fixes: Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000) - lib-lua: A HTTP client could not resolve DNS names in mail processes, because it expected "the dns-client" socket to exist in the current directory. - lib-oauth2: Dovecot would send client_id and client_secret as POST parameters to the introspection server. These need to be optionally in Basic auth instead. - lib-oauth2: JWT aud validation was not performed if aud was missing from a token, but was configured on Dovecot. - lib-oauth2: JWT key type check was too strict. - lib-oauth2: JWT token audience was not validated against client_id as required by the specification. - lib-ssl-iostream: Using the ssl_require_crl=yes setting may have caused CRL check failures for outgoing SSL/TLS connections, although it was supposed to affect checking CRLs only for client-side SSL certificates. v2.3.17 regression. - lib-sql: MySQL driver leaked memory when connection failed. - lib-storage: Various fixes when running into out of disk space. - master: Service idle_kill setting didn't work properly on busy servers. - mdbox: Temp file scan was done for always empty directories. - mdbox: The fdatasync() call was done in wrong parent directory when writing mails. Also on a failure it crashed instead of logging an error. - notify_status: The plugin crashes if any user initialization fails. - pop3: Sending command with the ':' character caused an assert-crash. v2.3.18 regression. Fixes: Panic: event_reason_code_prefix(): name has ':' - stats: Fix panic when a nonexistent event exporter was referenced while adding a new metric dynamically via doveadm stats add. - stats: If process exported a lot of events and then exited, some of the last events may have become lost. - stats: Invalid Prometheus label names were created with specific histogram group_by configurations. Prometheus rejected these labels. - welcome: The plugin didn't execute in some situations that created INBOX but didn't open it. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj