Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (23e492bd1c5afc4ce8c8cfa78119fd1ada977dc6)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (23e492bd1c5afc4ce8c8cfa78119fd1ada977dc6)
  • Date: Fri, 22 May 2015 13:16:04 -0500

GIT changes to stable-0.62 grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

mail/dovecot/DETAILS | 2 -
mail/dovecot/HISTORY | 6 ++++
mail/dovecot/PRE_BUILD | 3 ++
mail/dovecot/ssl_enhancedh.patch | 55
+++++++++++++++++++++++++++++++++++++++
4 files changed, 65 insertions(+), 1 deletion(-)

New commits:
commit 9290da217f84876a56a736c88e641ae5984e3bec
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

dovecot: security update

(cherry picked from commit 8a08cd3268cee993edb8cfa4cd986090a0e9a510)

diff --git a/mail/dovecot/DETAILS b/mail/dovecot/DETAILS
index 8550eac..e16fb3a 100755
--- a/mail/dovecot/DETAILS
+++ b/mail/dovecot/DETAILS
@@ -1,5 +1,6 @@
SPELL=dovecot
VERSION=2.0.21
+ SECURITY_PATCH=8
SOURCE=$SPELL-$VERSION.tar.gz
SOURCE2=$SOURCE.sig
SOURCE2_IGNORE=signature
@@ -18,7 +19,6 @@ if [[ "$DOVECOT_PIGEONHOLE" == "y" ]]; then
fi
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
ENTERED=20030224
- SECURITY_PATCH=7
LICENSE[0]=LGPL
LICENSE[1]=MIT
LICENSE[2]=BSD
diff --git a/mail/dovecot/HISTORY b/mail/dovecot/HISTORY
index 3df741c..1cde555 100644
--- a/mail/dovecot/HISTORY
+++ b/mail/dovecot/HISTORY
@@ -1,3 +1,9 @@
+2015-05-22 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH++ (increases the minimum Diffie-Hellman
group
+ size to 2048 bit)
+ * PRE_BUILD: apply patch; added security-related comments
+ * ssl_enhancedh.patch: added
+
2014-11-12 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: SECURITY_PATCH++ (allows turning off SSLv3); quoting paths;
unfold LICENSE; updated source urls for pigeonhole
diff --git a/mail/dovecot/PRE_BUILD b/mail/dovecot/PRE_BUILD
index bdabc87..78b6cb6 100755
--- a/mail/dovecot/PRE_BUILD
+++ b/mail/dovecot/PRE_BUILD
@@ -1,7 +1,10 @@
default_pre_build &&
cd $SOURCE_DIRECTORY &&

+# see CVE-2014-3566
patch -p0 < "$SPELL_DIRECTORY/ssl_protocols.patch" &&
+# see CVE-2015-4000
+patch -p0 < "$SPELL_DIRECTORY/ssl_enhancedh.patch" &&

if [[ "$DOVECOT_PIGEONHOLE" == "y" ]]; then
unpack_file 3
diff --git a/mail/dovecot/ssl_enhancedh.patch
b/mail/dovecot/ssl_enhancedh.patch
new file mode 100644
index 0000000..f9bbb61
--- /dev/null
+++ b/mail/dovecot/ssl_enhancedh.patch
@@ -0,0 +1,55 @@
+--- src/ssl-params/ssl-params-openssl.c.orig
++++ src/ssl-params/ssl-params-openssl.c
+@@ -13,7 +13,7 @@
+ default.. */
+ #define DH_GENERATOR 2
+
+-static int dh_param_bitsizes[] = { 512, 1024 };
++static int dh_param_bitsizes[] = { 512, 2048 };
+
+ static const char *ssl_last_error(void)
+ {
+--- src/login-common/ssl-proxy-openssl.c.orig
++++ src/login-common/ssl-proxy-openssl.c
+@@ -76,7 +76,7 @@
+ time_t last_refresh;
+ int fd;
+
+- DH *dh_512, *dh_1024;
++ DH *dh_512, *dh_2048;
+ };
+
+ struct ssl_server_context {
+@@ -182,8 +182,8 @@
+ case 512:
+ params->dh_512 = d2i_DHparams(NULL, &cbuf, len);
+ break;
+- case 1024:
+- params->dh_1024 = d2i_DHparams(NULL, &cbuf, len);
++ case 2048:
++ params->dh_2048 = d2i_DHparams(NULL, &cbuf, len);
+ break;
+ default:
+ ssl_params_corrupted();
+@@ -199,9 +199,9 @@
+ DH_free(params->dh_512);
+ params->dh_512 = NULL;
+ }
+- if (params->dh_1024 != NULL) {
+- DH_free(params->dh_1024);
+- params->dh_1024 = NULL;
++ if (params->dh_2048 != NULL) {
++ DH_free(params->dh_2048);
++ params->dh_2048 = NULL;
+ }
+ }
+
+@@ -796,7 +796,7 @@
+ if (is_export && keylength == 512 && ssl_params.dh_512 != NULL)
+ return ssl_params.dh_512;
+
+- return ssl_params.dh_1024;
++ return ssl_params.dh_2048;
+ }
+
+ static void ssl_info_callback(const SSL *ssl, int where, int ret)



  • [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (23e492bd1c5afc4ce8c8cfa78119fd1ada977dc6), Vlad Glagolev, 05/22/2015

Archive powered by MHonArc 2.6.24.

Top of Page