From patchwork Tue Apr 11 10:01:41 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vicente Olivert Riera X-Patchwork-Id: 749391 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3w2Mz84D2Mz9s8V for ; Tue, 11 Apr 2017 20:01:56 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 6646286CBF; Tue, 11 Apr 2017 10:01:54 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kOppa0Y95l7o; Tue, 11 Apr 2017 10:01:53 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by fraxinus.osuosl.org (Postfix) with ESMTP id CFB9986C5B; Tue, 11 Apr 2017 10:01:52 +0000 (UTC) X-Original-To: buildroot@lists.busybox.net Delivered-To: buildroot@osuosl.org Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by ash.osuosl.org (Postfix) with ESMTP id 62BC41C0099 for ; Tue, 11 Apr 2017 10:01:51 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 5541A888B5 for ; Tue, 11 Apr 2017 10:01:51 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7KpswSUyPhb0 for ; Tue, 11 Apr 2017 10:01:50 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mailapp01.imgtec.com (mailapp01.imgtec.com [195.59.15.196]) by whitealder.osuosl.org (Postfix) with ESMTP id 7679A87588 for ; Tue, 11 Apr 2017 10:01:50 +0000 (UTC) Received: from HHMAIL01.hh.imgtec.org (unknown [10.100.10.19]) by Forcepoint Email with ESMTPS id D33E8CB4CE3F8 for ; Tue, 11 Apr 2017 11:01:45 +0100 (IST) Received: from vriera-linux.le.imgtec.org (192.168.154.96) by HHMAIL01.hh.imgtec.org (10.100.10.21) with Microsoft SMTP Server (TLS) id 14.3.294.0; Tue, 11 Apr 2017 11:01:47 +0100 From: Vicente Olivert Riera To: Date: Tue, 11 Apr 2017 11:01:41 +0100 Message-ID: <20170411100141.1251-1-Vincent.Riera@imgtec.com> X-Mailer: git-send-email 2.10.2 MIME-Version: 1.0 X-Originating-IP: [192.168.154.96] Subject: [Buildroot] [PATCH] dovecot: bump version to 2.2.29 (security) X-BeenThere: buildroot@busybox.net X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: buildroot-bounces@busybox.net Sender: "buildroot" Security fix: passdb/userdb dict: Don't double-expand %variables in keys. If dict was used as the authentication passdb, using specially crafted %variables in the username could be used to cause DoS (CVE-2017-2669) Full ChangeLog: https://www.dovecot.org/list/dovecot-news/2017-April/000341.html Signed-off-by: Vicente Olivert Riera Acked-by: Bernd Kuhls --- package/dovecot/dovecot.hash | 2 +- package/dovecot/dovecot.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/dovecot/dovecot.hash b/package/dovecot/dovecot.hash index b52ea8d..7b9cb1d 100644 --- a/package/dovecot/dovecot.hash +++ b/package/dovecot/dovecot.hash @@ -1,2 +1,2 @@ # Locally computed after checking signature -sha256 e0288f59e326ab87cb3881fdabadafe542f4dc7ab9996db13863a439ebbc1f25 dovecot-2.2.28.tar.gz +sha256 d939ea99126eb8a8c6955390b422b6e27ec0fa43a3b59b2b3218cb5ad67139a6 dovecot-2.2.29.tar.gz diff --git a/package/dovecot/dovecot.mk b/package/dovecot/dovecot.mk index a7f6de4..566d099 100644 --- a/package/dovecot/dovecot.mk +++ b/package/dovecot/dovecot.mk @@ -5,7 +5,7 @@ ################################################################################ DOVECOT_VERSION_MAJOR = 2.2 -DOVECOT_VERSION = $(DOVECOT_VERSION_MAJOR).28 +DOVECOT_VERSION = $(DOVECOT_VERSION_MAJOR).29 DOVECOT_SITE = http://www.dovecot.org/releases/$(DOVECOT_VERSION_MAJOR) DOVECOT_INSTALL_STAGING = YES DOVECOT_LICENSE = LGPL-2.1