Operating System:

[SUSE]

Published:

18 February 2019

Protect yourself against future threats.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.0494
            SUSE Security Update: Security update for dovecot23
                             18 February 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           dovecot23
Publisher:         SUSE
Operating System:  SUSE
Impact/Access:     Provide Misleading Information -- Remote/Unauthenticated
                   Unauthorised Access            -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-3814  

Reference:         ESB-2019.0393
                   ESB-2019.0331
                   ESB-2019.0330

Original Bulletin: 
   https://www.suse.com/support/update/announcement/2019/suse-su-20190414-1.html

- --------------------------BEGIN INCLUDED TEXT--------------------

   SUSE Security Update: Security update for dovecot23
______________________________________________________________________________

Announcement ID:    SUSE-SU-2019:0414-1
Rating:             moderate
References:         #1119850 #1123022 #1124356 
Cross-References:   CVE-2019-3814
Affected Products:
                    SUSE Linux Enterprise Module for Server Applications 15
______________________________________________________________________________

   An update that solves one vulnerability and has two fixes
   is now available.

Description:


   This update for dovecot23 fixes the following issues:

   dovecot was updated to 2.3.3 release, bringing lots of bugfixes
   (bsc#1124356).

   Also the following security issue was fixed:

   - CVE-2019-3814: A vulnerability in Dovecot related to SSL client
     certificate authentication  was fixed (bsc#1123022)

   The package changes:

   Updated pigeonhole to 0.5.3:

   - Fix assertion panic occurring when managesieve service fails to
     open INBOX while saving a Sieve script. This was caused by a lack of
      cleanup after failure.
   - Fix specific messages causing an assert panic with actions that compose
     a reply (e.g. vacation). With some rather weird input from the original
     message, the header folding algorithm (as used for composing the
     References header for the reply) got confused, causing the panic.
   - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command parsing.
     After finishing reading the Sieve script, the command parsing sometimes
     didn't continue with the search arguments. This is a time- critical bug
     that likely only occurs when the Sieve script is sent in the next TCP
     frame.

   dovecot23 was updated to 2.3.3:

   - doveconf hides more secrets now in the default output.
   - ssl_dh setting is no longer enforced at startup. If it's not set and
     non-ECC DH key exchange happens, error is logged and client is
     disconnected.
   - Added log_debug=<filter> setting.
   - Added log_core_filter=<log filter> setting.
   - quota-clone: Write to dict asynchronously
   - --enable-hardening attempts to use retpoline Spectre 2 mitigations
   - lmtp proxy: Support source_ip passdb extra field.
   - doveadm stats dump: Support more fields and output stddev by default.
   - push-notification: Add SSL support for OX backend.
   - NUL bytes in mail headers can cause truncated replies when fetched.
   - director: Conflicting host up/down state changes may in some rare
     situations ended up in a loop of two directors constantly
     overwriting each others' changes.
   - director: Fix hang/crash when multiple doveadm commands are being
     handled concurrently.
   - director: Fix assert-crash if doveadm disconnects too early
   - virtual plugin: Some searches used 100% CPU for many seconds
   - dsync assert-crashed with acl plugin in some situations. (bsc#1119850)
   - mail_attachment_detection_options=add-flags-on-save assert-crashed with
     some specific Sieve scripts.
   - Mail snippet generation crashed with mails containing invalid
     Content-Type:multipart header.
   - Log prefix ordering was different for some log lines.
   - quota: With noenforcing option current quota usage wasn't updated.
   - auth: Kerberos authentication against Samba assert-crashed.
   - stats clients were unnecessarily chatty with the stats server.
   - imapc: Fixed various assert-crashes when reconnecting to server.
   - lmtp, submission: Fix potential crash if client disconnects while
     handling a command.
   - quota: Fixed compiling with glibc-2.26 / support libtirpc.
   - fts-solr: Empty search values resulted in 400 Bad Request errors
   - fts-solr: default_ns parameter couldn't be used
   - submission server crashed if relay server returned over 7 lines in a
     reply (e.g. to EHLO)

   dovecot was updated to 2.3.2.1:

   - SSL/TLS servers may have crashed during client disconnection
   - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have sometimes
     assert-crashed.
   - v2.3.2: "make check" may have crashed with 32bit systems

   dovecot was updated to 2.3.2:

   - old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE while opening
     /proc/self/io. This may still cause security problems if the process is
     ptrace()d at the same time. Instead, open it while still running as root.
   - doveadm: Added mailbox cache decision&remove commands. See
     doveadm-mailbox(1) man page for details.
   - doveadm: Added rebuild attachments command for rebuilding $HasAttachment
     or $HasNoAttachment flags for matching mails. See doveadm-rebuild(1) man
     page for details.
   - cassandra: Use fallback_consistency on more types of errors
   - lmtp proxy: Support outgoing SSL/TLS connections
   - lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
   - submission: Add support for rawlog_dir
   - submission: Add submission_client_workarounds setting.
   - lua auth: Add password_verify() function and additional fields in auth
     request.
   - doveadm-server: TCP connections are hanging when there is a lot
     of network output. This especially caused hangs in dsync-replication.
   - Using multiple type=shared mdbox namespaces crashed
   - mail_fsync setting was ignored. It was always set to "optimized".
   - lua auth: Fix potential crash at deinit
   - SSL/TLS servers may have crashed if client disconnected during handshake.
   - SSL/TLS servers: Don't send extraneous certificates to client when alt
     certs are used.
   - lda, lmtp: Return-Path header without '<' may have assert-crashed.
   - lda, lmtp: Unencoded UTF-8 in email address headers may assert-crash
   - lda: -f parameter didn't allow empty/null/domainless address
   - lmtp, submission: Message size limit was hardcoded to 40 MB. Exceeding
     it caused the connection to get dropped during transfer.
   - lmtp: Fix potential crash when delivery fails at DATA stage
   - lmtp: login_greeting setting was ignored
   - Fix to work with OpenSSL v1.0.2f
   - systemd unit restrictions were too strict by default
   - Fix potential crashes when a lot of log output was produced
   - SMTP client may have assert-crashed when sending mail
   - IMAP COMPRESS: Send "end of compression" marker when disconnecting.
   - cassandra: Fix consistency=quorum to work
   - dsync: Lock file generation failed if home directory didn't exist
   - Snippet generation for HTML mails didn't ignore &entities inside
     blockquotes, producing strange looking snippets.
   - imapc: Fix assert-crash if getting disconnected and after reconnection
     all mails in the selected mailbox are gone.
   - pop3c: Handle unexpected server disconnections without assert-crash
   - fts: Fixes to indexing mails via virtual mailboxes.
   - fts: If mails contained NUL characters, the text around it wasn't
     indexed.
   - Obsolete dovecot.index.cache offsets were sometimes used. Trying to
     fetch a field that was just added to cache file may not have always
     found it.

   pigeonhole was updated to 0.5.2:

   - Implement plugin for the a vendor-defined IMAP capability called
     "FILTER=SIEVE". It adds the ability to manually invoke Sieve filtering
     in IMAP. More information can be found in
     doc/plugins/imap_filter_sieve.txt.
   - The Sieve addess test caused an assertion panic for invalid addresses
     with UTF-8 codepoints in the localpart. Fixed by properly detecting
     invalid addresses with UTF-8 codepoints in the localpart and skipping
     these like other invalid addresses while iterating addresses for the
     address test.
   - Make the length of the subject header for the vacation response
     configurable and enforce the limit in UTF-8 codepoints rather than
     bytes. The subject header for a vacation response was statically
     truncated to 256 bytes, which is too limited for multi-byte UTF-8
     characters.
   - Sieve editheader extension: Fix assertion panic occurring when it is
     used to manipulate a message header with a very large header field.
   - Properly abort execution of the sieve_discard script upon error.
     Before, the LDA Sieve plugin attempted to execute the sieve_discard
     script when an error occurs. This can lead to the message being lost.
   - Fix the interaction between quota and the sieve_discard script. When
     quota was used together with a sieve_discard script, the message
     delivery did not bounce when the quota was exceeded.
   - Fix crash for over quota users


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Server Applications 15:

      zypper in -t patch SUSE-SLE-Module-Server-Applications-15-2019-414=1



Package List:

   - SUSE Linux Enterprise Module for Server Applications 15 (aarch64 ppc64le s390x x86_64):

      dovecot23-2.3.3-4.7.4
      dovecot23-backend-mysql-2.3.3-4.7.4
      dovecot23-backend-mysql-debuginfo-2.3.3-4.7.4
      dovecot23-backend-pgsql-2.3.3-4.7.4
      dovecot23-backend-pgsql-debuginfo-2.3.3-4.7.4
      dovecot23-backend-sqlite-2.3.3-4.7.4
      dovecot23-backend-sqlite-debuginfo-2.3.3-4.7.4
      dovecot23-debuginfo-2.3.3-4.7.4
      dovecot23-debugsource-2.3.3-4.7.4
      dovecot23-devel-2.3.3-4.7.4
      dovecot23-fts-2.3.3-4.7.4
      dovecot23-fts-debuginfo-2.3.3-4.7.4
      dovecot23-fts-lucene-2.3.3-4.7.4
      dovecot23-fts-lucene-debuginfo-2.3.3-4.7.4
      dovecot23-fts-solr-2.3.3-4.7.4
      dovecot23-fts-solr-debuginfo-2.3.3-4.7.4
      dovecot23-fts-squat-2.3.3-4.7.4
      dovecot23-fts-squat-debuginfo-2.3.3-4.7.4


References:

   https://www.suse.com/security/cve/CVE-2019-3814.html
   https://bugzilla.suse.com/1119850
   https://bugzilla.suse.com/1123022
   https://bugzilla.suse.com/1124356

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXGoN7WaOgq3Tt24GAQidFg/7Besj0JVU5K6pxdswqGhc7jQfQikUPZ27
vq8DFVhv86sASA2NBemzh/5vnDw2v62E55IWMjBFUktjWLu4dphFOuuRJayGRpA0
eSFokuFvkHA+66vcDBvltZ2ddVRgsulTYRxT82r15ZwsrxdK8e9X399yJ1/r+1pV
M7BsEEd89YS9v/pgazET5GMXTapQJGu4P+SxosEPR19N1VaN+9LE+0zGS30QjSyH
YbzunXs9fFfLhgzLtcQmI3SfbtNr3lQ7N44v/j6knm0Tr8clflDLAFWp7a2QNa3B
eq2AJKjM1Mft38a1peFuU0NIikZnvlOwJAKF/bkZcQdcQ1XRkU58tw6d3GnY8tUa
PuRr84c8c35ZCF0ZHuHoMRicoxSDF3FbJGNgI+619hhGzOuV7Dgk49q4Ls5tec8p
m5U+F70r9RzyuCyPqFKbhG+TLTARWOGBwuHd3zLvn43ZDuvfdNUzA4r/RnoOY9ty
SduaOcThNjuWZ9KHeW9fsnsuInn/Myd2FATD74S1Rqsz09xmk0+x+luvbhDQvxyg
tsF+4uz3oX1NAR0PqxUsR5bfurJMPhDy7sui1x+ykFu6OOKgphvJmz8gFZAwgz1j
aIkEhLJ24z/AQ5VCPFZ6e9fl+hssHpt4UnamvJLmCElVEijHVLsc/AAKbj/t+iMm
4HB/Xl95lHc=
=2JOY
-----END PGP SIGNATURE-----