2 files changed, 143 insertions, 0 deletions
diff --git a/meta-networking/recipes-support/dovecot/dovecot/CVE-2025-59031.patch b/meta-networking/recipes-support/dovecot/dovecot/CVE-2025-59031.patch
new file mode 100644
index 0000000000..6f13502422
--- /dev/null
+++ b/meta-networking/recipes-support/dovecot/dovecot/CVE-2025-59031.patch
@@ -0,0 +1,142 @@
+From aac45a278d95afeec8c702b5b4966ea0a96e5ad6 Mon Sep 17 00:00:00 2001
+From: Aki Tuomi <aki.tuomi@open-xchange.com>
+Date: Thu, 8 Jan 2026 08:51:59 +0200
+Subject: [PATCH] fts: Remove decode2text.sh
+The script is flawed and not fit for production use, should
+recommend writing your own script, or using Apache Tika.
+CVE: CVE-2025-59031
+Upstream-Status: Backport [https://github.com/dovecot/core/commit/36a95e7fa6b913db6c03a15862628b06be66eb3e]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ src/plugins/fts/Makefile.am    |   3 -
+ src/plugins/fts/decode2text.sh | 105 ---------------------------------
+ 2 files changed, 108 deletions(-)
+ delete mode 100755 src/plugins/fts/decode2text.sh
+diff --git a/src/plugins/fts/Makefile.am b/src/plugins/fts/Makefile.am
+index ae57d8f..4485cf4 100644
+--- a/src/plugins/fts/Makefile.am
+++ b/src/plugins/fts/Makefile.am
+@@ -65,9 +65,6 @@ xml2text_CPPFLAGS = $(AM_CPPFLAGS) $(BINARY_CFLAGS)
+ xml2text_LDADD = $(LIBDOVECOT) $(BINARY_LDFLAGS)
+ xml2text_DEPENDENCIES = $(module_LTLIBRARIES) $(LIBDOVECOT_DEPS)
+ 
+-pkglibexec_SCRIPTS = decode2text.sh
+-EXTRA_DIST = $(pkglibexec_SCRIPTS)
+-
+ doveadm_module_LTLIBRARIES = \
+        lib20_doveadm_fts_plugin.la
+ 
+diff --git a/src/plugins/fts/decode2text.sh b/src/plugins/fts/decode2text.sh
+deleted file mode 100755
+index 151fb7c..0000000
+--- a/src/plugins/fts/decode2text.sh
+++ /dev/null
+@@ -1,105 +0,0 @@
+-#!/bin/sh
+-
+-# Example attachment decoder script. The attachment comes from stdin, and
+-# the script is expected to output UTF-8 data to stdout. (If the output isn't
+-# UTF-8, everything except valid UTF-8 sequences are dropped from it.)
+-
+-# The attachment decoding is enabled by setting:
+-#
+-# plugin {
+-#   fts_decoder = decode2text
+-# }
+-# service decode2text {
+-#   executable = script /usr/local/libexec/dovecot/decode2text.sh
+-#   user = dovecot
+-#   unix_listener decode2text {
+-#     mode = 0666
+-#   }
+-# }
+-
+-libexec_dir=`dirname $0`
+-content_type=$1
+-
+-# The second parameter is the format's filename extension, which is used when
+-# found from a filename of application/octet-stream. You can also add more
+-# extensions by giving more parameters.
+-formats='application/pdf pdf
+-application/x-pdf pdf
+-application/msword doc
+-application/mspowerpoint ppt
+-application/vnd.ms-powerpoint ppt
+-application/ms-excel xls
+-application/x-msexcel xls
+-application/vnd.ms-excel xls
+-application/vnd.openxmlformats-officedocument.wordprocessingml.document docx
+-application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx
+-application/vnd.openxmlformats-officedocument.presentationml.presentation pptx
+-application/vnd.oasis.opendocument.text odt
+-application/vnd.oasis.opendocument.spreadsheet ods
+-application/vnd.oasis.opendocument.presentation odp
+-'
+-
+-if [ "$content_type" = "" ]; then
+-  echo "$formats"
+-  exit 0
+-fi
+-
+-fmt=`echo "$formats" | grep -w "^$content_type" | cut -d ' ' -f 2`
+-if [ "$fmt" = "" ]; then
+-  echo "Content-Type: $content_type not supported" >&2
+-  exit 1
+-fi
+-
+-# most decoders can't handle stdin directly, so write the attachment
+-# to a temp file
+-path=`mktemp`
+-trap "rm -f $path" 0 1 2 3 14 15
+-cat > $path
+-
+-xmlunzip() {
+-  name=$1
+-
+-  tempdir=`mktemp -d`
+-  if [ "$tempdir" = "" ]; then
+-    exit 1
+-  fi
+-  trap "rm -rf $path $tempdir" 0 1 2 3 14 15
+-  cd $tempdir || exit 1
+-  unzip -q "$path" 2>/dev/null || exit 0
+-  find . -name "$name" -print0 | xargs -0 cat |
+-    $libexec_dir/xml2text
+-}
+-
+-wait_timeout() {
+-  childpid=$!
+-  trap "kill -9 $childpid; rm -f $path" 1 2 3 14 15
+-  wait $childpid
+-}
+-
+-LANG=en_US.UTF-8
+-export LANG
+-if [ $fmt = "pdf" ]; then
+-  /usr/bin/pdftotext $path - 2>/dev/null&
+-  wait_timeout 2>/dev/null
+-elif [ $fmt = "doc" ]; then
+-  (/usr/bin/catdoc $path; true) 2>/dev/null&
+-  wait_timeout 2>/dev/null
+-elif [ $fmt = "ppt" ]; then
+-  (/usr/bin/catppt $path; true) 2>/dev/null&
+-  wait_timeout 2>/dev/null
+-elif [ $fmt = "xls" ]; then
+-  (/usr/bin/xls2csv $path; true) 2>/dev/null&
+-  wait_timeout 2>/dev/null
+-elif [ $fmt = "odt" -o $fmt = "ods" -o $fmt = "odp" ]; then
+-  xmlunzip "content.xml"
+-elif [ $fmt = "docx" ]; then
+-  xmlunzip "document.xml"
+-elif [ $fmt = "xlsx" ]; then
+-  xmlunzip "sharedStrings.xml"
+-elif [ $fmt = "pptx" ]; then
+-  xmlunzip "slide*.xml"
+-else
+-  echo "Buggy decoder script: $fmt not handled" >&2
+-  exit 1
+-fi
+-exit 0
diff --git a/meta-networking/recipes-support/dovecot/dovecot_2.4.1-4.bb b/meta-networking/recipes-support/dovecot/dovecot_2.4.1-4.bb
index 09583f1694..769e693c5a 100644
--- a/meta-networking/recipes-support/dovecot/dovecot_2.4.1-4.bb
+++ b/meta-networking/recipes-support/dovecot/dovecot_2.4.1-4.bb
@@ -22,6 +22,7 @@ SRC_URI = "http://dovecot.org/releases/2.4/dovecot-${PV}.tar.gz \
           file://CVE-2025-30189-5.patch \
           file://CVE-2025-30189-6.patch \
           file://CVE-2025-30189-7.patch \
+           file://CVE-2025-59031.patch \
           "
 SRC_URI[sha256sum] = "fb188603f419ed7aaa07794a8692098c3ec2660bb9c67d0efe24948cbb32ae00"

diff --git a/meta-networking/recipes-support/dovecot/dovecot/CVE-2025-59031.patch b/meta-networking/recipes-support/dovecot/dovecot/CVE-2025-59031.patch new file mode 100644 index 0000000000..6f13502422 --- /dev/null +++ b/meta-networking/recipes-support/dovecot/dovecot/CVE-2025-59031.patch
@@ -0,0 +1,142 @@
		1	From aac45a278d95afeec8c702b5b4966ea0a96e5ad6 Mon Sep 17 00:00:00 2001
		2	From: Aki Tuomi <aki.tuomi@open-xchange.com>
		3	Date: Thu, 8 Jan 2026 08:51:59 +0200
		4	Subject: [PATCH] fts: Remove decode2text.sh
		5
		6	The script is flawed and not fit for production use, should
		7	recommend writing your own script, or using Apache Tika.
		8
		9	CVE: CVE-2025-59031
		10	Upstream-Status: Backport [https://github.com/dovecot/core/commit/36a95e7fa6b913db6c03a15862628b06be66eb3e]
		11	Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
		12	---
		13	src/plugins/fts/Makefile.am \| 3 -
		14	src/plugins/fts/decode2text.sh \| 105 ---------------------------------
		15	2 files changed, 108 deletions(-)
		16	delete mode 100755 src/plugins/fts/decode2text.sh
		17
		18	diff --git a/src/plugins/fts/Makefile.am b/src/plugins/fts/Makefile.am
		19	index ae57d8f..4485cf4 100644
		20	--- a/src/plugins/fts/Makefile.am
		21	+++ b/src/plugins/fts/Makefile.am
		22	@@ -65,9 +65,6 @@ xml2text_CPPFLAGS = $(AM_CPPFLAGS) $(BINARY_CFLAGS)
		23	xml2text_LDADD = $(LIBDOVECOT) $(BINARY_LDFLAGS)
		24	xml2text_DEPENDENCIES = $(module_LTLIBRARIES) $(LIBDOVECOT_DEPS)
		25
		26	-pkglibexec_SCRIPTS = decode2text.sh
		27	-EXTRA_DIST = $(pkglibexec_SCRIPTS)
		28	-
		29	doveadm_module_LTLIBRARIES = \
		30	lib20_doveadm_fts_plugin.la
		31
		32	diff --git a/src/plugins/fts/decode2text.sh b/src/plugins/fts/decode2text.sh
		33	deleted file mode 100755
		34	index 151fb7c..0000000
		35	--- a/src/plugins/fts/decode2text.sh
		36	+++ /dev/null
		37	@@ -1,105 +0,0 @@
		38	-#!/bin/sh
		39	-
		40	-# Example attachment decoder script. The attachment comes from stdin, and
		41	-# the script is expected to output UTF-8 data to stdout. (If the output isn't
		42	-# UTF-8, everything except valid UTF-8 sequences are dropped from it.)
		43	-
		44	-# The attachment decoding is enabled by setting:
		45	-#
		46	-# plugin {
		47	-# fts_decoder = decode2text
		48	-# }
		49	-# service decode2text {
		50	-# executable = script /usr/local/libexec/dovecot/decode2text.sh
		51	-# user = dovecot
		52	-# unix_listener decode2text {
		53	-# mode = 0666
		54	-# }
		55	-# }
		56	-
		57	-libexec_dir=`dirname $0`
		58	-content_type=$1
		59	-
		60	-# The second parameter is the format's filename extension, which is used when
		61	-# found from a filename of application/octet-stream. You can also add more
		62	-# extensions by giving more parameters.
		63	-formats='application/pdf pdf
		64	-application/x-pdf pdf
		65	-application/msword doc
		66	-application/mspowerpoint ppt
		67	-application/vnd.ms-powerpoint ppt
		68	-application/ms-excel xls
		69	-application/x-msexcel xls
		70	-application/vnd.ms-excel xls
		71	-application/vnd.openxmlformats-officedocument.wordprocessingml.document docx
		72	-application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx
		73	-application/vnd.openxmlformats-officedocument.presentationml.presentation pptx
		74	-application/vnd.oasis.opendocument.text odt
		75	-application/vnd.oasis.opendocument.spreadsheet ods
		76	-application/vnd.oasis.opendocument.presentation odp
		77	-'
		78	-
		79	-if [ "$content_type" = "" ]; then
		80	- echo "$formats"
		81	- exit 0
		82	-fi
		83	-
		84	-fmt=`echo "$formats" \| grep -w "^$content_type" \| cut -d ' ' -f 2`
		85	-if [ "$fmt" = "" ]; then
		86	- echo "Content-Type: $content_type not supported" >&2
		87	- exit 1
		88	-fi
		89	-
		90	-# most decoders can't handle stdin directly, so write the attachment
		91	-# to a temp file
		92	-path=`mktemp`
		93	-trap "rm -f $path" 0 1 2 3 14 15
		94	-cat > $path
		95	-
		96	-xmlunzip() {
		97	- name=$1
		98	-
		99	- tempdir=`mktemp -d`
		100	- if [ "$tempdir" = "" ]; then
		101	- exit 1
		102	- fi
		103	- trap "rm -rf $path $tempdir" 0 1 2 3 14 15
		104	- cd $tempdir \|\| exit 1
		105	- unzip -q "$path" 2>/dev/null \|\| exit 0
		106	- find . -name "$name" -print0 \| xargs -0 cat \|
		107	- $libexec_dir/xml2text
		108	-}
		109	-
		110	-wait_timeout() {
		111	- childpid=$!
		112	- trap "kill -9 $childpid; rm -f $path" 1 2 3 14 15
		113	- wait $childpid
		114	-}
		115	-
		116	-LANG=en_US.UTF-8
		117	-export LANG
		118	-if [ $fmt = "pdf" ]; then
		119	- /usr/bin/pdftotext $path - 2>/dev/null&
		120	- wait_timeout 2>/dev/null
		121	-elif [ $fmt = "doc" ]; then
		122	- (/usr/bin/catdoc $path; true) 2>/dev/null&
		123	- wait_timeout 2>/dev/null
		124	-elif [ $fmt = "ppt" ]; then
		125	- (/usr/bin/catppt $path; true) 2>/dev/null&
		126	- wait_timeout 2>/dev/null
		127	-elif [ $fmt = "xls" ]; then
		128	- (/usr/bin/xls2csv $path; true) 2>/dev/null&
		129	- wait_timeout 2>/dev/null
		130	-elif [ $fmt = "odt" -o $fmt = "ods" -o $fmt = "odp" ]; then
		131	- xmlunzip "content.xml"
		132	-elif [ $fmt = "docx" ]; then
		133	- xmlunzip "document.xml"
		134	-elif [ $fmt = "xlsx" ]; then
		135	- xmlunzip "sharedStrings.xml"
		136	-elif [ $fmt = "pptx" ]; then
		137	- xmlunzip "slide*.xml"
		138	-else
		139	- echo "Buggy decoder script: $fmt not handled" >&2
		140	- exit 1
		141	-fi
		142	-exit 0


diff --git a/meta-networking/recipes-support/dovecot/dovecot_2.4.1-4.bb b/meta-networking/recipes-support/dovecot/dovecot_2.4.1-4.bb index 09583f1694..769e693c5a 100644 --- a/meta-networking/recipes-support/dovecot/dovecot_2.4.1-4.bb +++ b/meta-networking/recipes-support/dovecot/dovecot_2.4.1-4.bb
@@ -22,6 +22,7 @@ SRC_URI = "http://dovecot.org/releases/2.4/dovecot-${PV}.tar.gz \
22	file://CVE-2025-30189-5.patch \	22	file://CVE-2025-30189-5.patch \
23	file://CVE-2025-30189-6.patch \	23	file://CVE-2025-30189-6.patch \
24	file://CVE-2025-30189-7.patch \	24	file://CVE-2025-30189-7.patch \
		25	file://CVE-2025-59031.patch \
25	"	26	"
26	SRC_URI[sha256sum] = "fb188603f419ed7aaa07794a8692098c3ec2660bb9c67d0efe24948cbb32ae00"	27	SRC_URI[sha256sum] = "fb188603f419ed7aaa07794a8692098c3ec2660bb9c67d0efe24948cbb32ae00"
27		28