Issued:

2015-07-22

Updated:

2015-07-22

RHBA-2015:1348 - dovecot bug fix and enhancement update

Synopsis

dovecot bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

Updated dovecot packages that fix several bugs and add one enhancement are now available for Red Hat Enterprise Linux 6.

Description

Dovecot is an IMAP server for Linux and other UNIX-like systems, primarily written with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

This update fixes the following bugs:

• The ports used by dovecot were in some cases unavailable during the boot process by other services, which caused dovecot to fail to start and display an "Address already in use" error. This update configures the portreserve service to ensure that dovecot's ports stay available during the boot process, which prevents the described failure from occurring. (BZ#723228)

• Previously, the dovecot utility used too small a login input buffer for Kerberos authentication. As a consequence, users who attempted to use Kerberos authentication were not able to log in. This updated version of dovecot uses a bigger input buffer, and users can now authenticate to their email accounts using a Kerberos ticket. (BZ#771336)

• Prior to this update, dovecot logged a redundant "unable to get certificate" error message when no certification revocation list (CRL) was available. With this update, dovecot no longer treats missing CRL as an error, and no longer logs an error in the mentioned scenario. (BZ#813957)

• When the LIST-STATUS extension was used with certain hierarchy separator symbols, dovecot in some cases terminated unexpectedly. Consequently, the user was unable to list the contents of their e-mail folder. This update fixes the code for traversing folders, and using LIST-STATUS no longer causes dovecot to crash. (BZ#961466)

• Previously, after executing the "uid copy" command against a non-existent mailbox, the dovecot server became unresponsive. As a consequence, the user could not download e-mails unless recovered manually. A patch has been provided to fix this bug, and dovecot no longer hangs in the aforementioned scenario. (BZ#1131749)

In addition, this update adds the following enhancement:

• With this update, it is possible to configure which Secure Sockets Layer (SSL) protocols dovecot allows. Among other things, this allows users to disable SSLv3 connections and thus mitigate the impact of the POODLE vulnerability. Due to security concerns, SSLv2 and SSLv3 are now also disabled by default, and the user has to be allow them manually if required. (BZ#1153041)

Users of dovecot are advised to upgrade to these updated packages, which fix these bugs and add this enhancement.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Updated Packages

• dovecot-debuginfo-2.0.9-19.el6.s390x.rpm
• dovecot-2.0.9-19.el6.s390.rpm
• dovecot-2.0.9-19.el6.s390x.rpm
• dovecot-devel-2.0.9-19.el6.ppc64.rpm
• dovecot-mysql-2.0.9-19.el6.s390x.rpm
• dovecot-debuginfo-2.0.9-19.el6.i686.rpm
• dovecot-debuginfo-2.0.9-19.el6.x86_64.rpm
• dovecot-mysql-2.0.9-19.el6.ppc64.rpm
• dovecot-devel-2.0.9-19.el6.x86_64.rpm
• dovecot-2.0.9-19.el6.x86_64.rpm
• dovecot-debuginfo-2.0.9-19.el6.s390.rpm
• dovecot-mysql-2.0.9-19.el6.x86_64.rpm
• dovecot-2.0.9-19.el6.src.rpm
• dovecot-mysql-2.0.9-19.el6.i686.rpm
• dovecot-devel-2.0.9-19.el6.i686.rpm
• dovecot-pgsql-2.0.9-19.el6.s390x.rpm
• dovecot-pigeonhole-2.0.9-19.el6.i686.rpm
• dovecot-pgsql-2.0.9-19.el6.ppc64.rpm
• dovecot-pigeonhole-2.0.9-19.el6.ppc64.rpm
• dovecot-2.0.9-19.el6.ppc64.rpm
• dovecot-debuginfo-2.0.9-19.el6.ppc.rpm
• dovecot-devel-2.0.9-19.el6.s390x.rpm
• dovecot-debuginfo-2.0.9-19.el6.ppc64.rpm
• dovecot-2.0.9-19.el6.i686.rpm
• dovecot-pgsql-2.0.9-19.el6.x86_64.rpm
• dovecot-pgsql-2.0.9-19.el6.i686.rpm
• dovecot-pigeonhole-2.0.9-19.el6.x86_64.rpm
• dovecot-pigeonhole-2.0.9-19.el6.s390x.rpm
• dovecot-2.0.9-19.el6.ppc.rpm

Fixes

• This content is not included.BZ - 730746
• This content is not included.BZ - 813957
• This content is not included.BZ - 961466
• This content is not included.BZ - 1100756
• This content is not included.BZ - 1124783
• This content is not included.BZ - 1140459
• This content is not included.BZ - 1153041
• This content is not included.BZ - 1182619
• This content is not included.BZ - 1184865

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.