Skip to contentSkip to conversation

dovecot: bump version to 2.2.27 (security)

PATCH New Vicente Olivert Riera 3 participants 6 messages Dec 9, 2016 – Dec 10, 2016

lore
Share & tools
lore

Vicente Olivert Riera

author
#0 lore raw

PATCH 1/2 dovecot: bump version to 2.2.27 (security)

Fixes CVE-2016-8652 : http://www.securityfocus.com/bid/94639/

Release notes:
http://www.dovecot.org/list/dovecot-news/2016-December/000333.html

Signed-off-by Vicente Olivert Riera <[email protected]>
---
 package/dovecot/dovecot.hash | 4 ++--
 package/dovecot/dovecot.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
package/dovecot/dovecot.hash +2 -2
index 0f67f0e..e7b9c33 100644
@@ -1,2 +1,2 @@
-# Locally computed
-sha256	d8d9f32c846397f7c22749a84c5cf6f59c55ff7ded3dc9f07749a255182f9667	dovecot-2.2.25.tar.gz
+# Locally computed after checking signature
+sha256 897f92a87cda4b27b243f8149ce0ba7b7e71a2be8fb7994eb0a025e54cde18e9  dovecot-2.2.27.tar.gz
package/dovecot/dovecot.mk +1 -1
index 31c62d3..3dd231a 100644
@@ -5,7 +5,7 @@
 ################################################################################
 
 DOVECOT_VERSION_MAJOR = 2.2
-DOVECOT_VERSION = $(DOVECOT_VERSION_MAJOR).25
+DOVECOT_VERSION = $(DOVECOT_VERSION_MAJOR).27
 DOVECOT_SITE = http://www.dovecot.org/releases/$(DOVECOT_VERSION_MAJOR)
 DOVECOT_INSTALL_STAGING = YES
 DOVECOT_LICENSE = LGPLv2.1
Signature · 1 line
2.10.1
author
#1 lore raw

PATCH 2/2 dovecot-pigeonhole: bump version to 0.4.16

Release notes:
http://www.dovecot.org/list/dovecot-news/2016-October/000330.html

Signed-off-by Vicente Olivert Riera <[email protected]>
---
 package/dovecot-pigeonhole/dovecot-pigeonhole.hash | 4 ++--
 package/dovecot-pigeonhole/dovecot-pigeonhole.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
package/dovecot-pigeonhole/dovecot-pigeonhole.hash +2 -2
index f598825..95325a9 100644
@@ -1,2 +1,2 @@
-# Locally computed
-sha256	c99ace6ead310c6c3b639922da618f90d846307da4fe252d994e5e51bf8a3de3	dovecot-2.2-pigeonhole-0.4.15.tar.gz
+# Locally computed after checking signature
+sha256 8f0b98f18062d6e241eef74ebe16cc167cd246361cbe6657d94f0ecc5d7d3234  dovecot-2.2-pigeonhole-0.4.16.tar.gz
package/dovecot-pigeonhole/dovecot-pigeonhole.mk +1 -1
index 7c0a14c..846e7f9 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-DOVECOT_PIGEONHOLE_VERSION = 0.4.15
+DOVECOT_PIGEONHOLE_VERSION = 0.4.16
 DOVECOT_PIGEONHOLE_SOURCE = dovecot-2.2-pigeonhole-$(DOVECOT_PIGEONHOLE_VERSION).tar.gz
 DOVECOT_PIGEONHOLE_SITE = http://pigeonhole.dovecot.org/releases/2.2
 DOVECOT_PIGEONHOLE_LICENSE = LGPLv2.1
Signature · 1 line
2.10.1
#3 lore raw

PATCH 1/2 dovecot: bump version to 2.2.27 (security)

In reply to Vicente Olivert Riera
Quoted 7 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Vicente" == Vicente Olivert Riera <[email protected]> writes:

Fixes CVE-2016-8652 : http://www.securityfocus.com/bid/94639/
Release notes:
http://www.dovecot.org/list/dovecot-news/2016-December/000333.html

Signed-off-by Vicente Olivert Riera <[email protected]>

Committed, thanks.

Signature · 1 line
Bye, Peter Korsgaard
#4 lore raw

PATCH 1/2 dovecot: bump version to 2.2.27 (security)

In reply to Vicente Olivert Riera

Hello,

Adding Bernd in Cc.

Quoted 6 lines · Vicente Olivert Riera

Fixes CVE-2016-8652 : http://www.securityfocus.com/bid/94639/

Release notes:
http://www.dovecot.org/list/dovecot-news/2016-December/000333.html

Signed-off-by Vicente Olivert Riera <[email protected]>

This update causes a large number of build failures:

http://autobuild.buildroot.net/?reason=dovecot-2.2.27

Basically, dovecot no longer builds without OpenSSL support. The configure error can be fixed by adding the attached patch (+ a host-gettext dependency + autoreconf + creating m4). But then, the build fails with:

In file included from test-http-client.c:12:0:
../../src/lib-ssl-iostream/iostream-openssl.h:6:25: fatal error: openssl/ssl.h: No such file or directory
#include <openssl/ssl.h>

And http://www.mail-archive.com/dovecot at dovecot.org/msg67930.html is not very encouraging in terms of supporting the build of Dovecot without OpenSSL.

So could you submit a patch that either fixes the build of Dovecot without OpenSSL, or makes OpenSSL support mandatory?

Thanks,

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux and Kernel engineering
http://free-electrons.com
#5 lore raw

PATCH 1/2 dovecot: bump version to 2.2.27 (security)

Hello,

Quoted 4 lines · Thomas Petazzoni

Basically, dovecot no longer builds without OpenSSL support. The configure error can be fixed by adding the attached patch (+ a host-gettext dependency + autoreconf + creating m4). But then, the build fails with:

Now with the patch attached.

Thomas

Signature · 10 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux and Kernel engineering
http://free-electrons.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-configure.ac-AM_CONDITIONAL-should-not-be-inside-a-c.patch
Type: text/x-patch
Size: 1644 bytes
Desc: not available
URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20161210/452d12bd/attachment.bin>