dovecot (1:2.3.21+dfsg1-2ubuntu6.1) noble; urgency=medium

  * Update PBKDF2 salt length to be FIPS 140-3 compliant (LP: #2107773).

 -- Eric Berry <eric.berry@canonical.com>  Fri, 03 Oct 2025 15:37:20 -0700

dovecot (1:2.3.21+dfsg1-2ubuntu6) noble-security; urgency=medium

  * Patches for CVE-2024-23184, CVE-2024-23185 (LP: #2077324).
    - CVE-2024-23184: A large number of address headers in email resulted
      in excessive CPU usage.
      + d/p/CVE-2024-23184-1-lib-test-llist-Fix-dllist2-test-name.patch
      + d/p/CVE-2024-23184-2-lib-Add-DLLIST2_JOIN.patch
      + d/p/CVE-2024-23184-3-lib-mail-test-imap-envelope-Use-test_assert_idx-where-pos.patch
      + d/p/CVE-2024-23184-4-lib-mail-Change-message_address-to-be-doubly-linked-list.patch
      + d/p/CVE-2024-23184-5-lib-mail-Add-message_address_parse_full-and-struct-messag.patch
      + d/p/CVE-2024-23184-6-lib-mail-lib-imap-Optimize-parsing-large-number-of-addres.patch
    - CVE-2024-23185: Abnormally large email headers are now truncated or
      discarded, with a limit of 10MB on a single header and 50MB for all
      the headers of all the parts of an email.
      + d/p/CVE-2024-23185-1-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
      + d/p/CVE-2024-23185-2-lib-mail-message-parser-Limit-headers-total-count-to-50MB.patch
    For more information see the following articles:
    CVE-2024-23184 - https://www.openwall.com/lists/oss-security/2024/08/15/3
    CVE-2024-23185 - https://www.openwall.com/lists/oss-security/2024/08/15/4

 -- Mitchell Dzurick <mitchell.dzurick@canonical.com>  Mon, 26 Aug 2024 08:52:27 -0700

dovecot (1:2.3.21+dfsg1-2ubuntu5) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 08:49:22 +0000

dovecot (1:2.3.21+dfsg1-2ubuntu4) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 17:46:12 +0000

dovecot (1:2.3.21+dfsg1-2ubuntu3) noble; urgency=medium

  * No-change rebuild against libtirpc3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 29 Feb 2024 09:22:26 +0000

dovecot (1:2.3.21+dfsg1-2ubuntu2) noble; urgency=medium

  * No-change rebuild for ICU soname change.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 19 Dec 2023 18:37:56 +0100

dovecot (1:2.3.21+dfsg1-2ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2040378). Remaining changes:
    - d/rules: set mbranch-protection=bti to avoid ftbfs.
      (LP #2036268)

 -- Bryce Harrington <bryce@canonical.com>  Mon, 13 Nov 2023 14:50:25 -0800

dovecot (1:2.3.21+dfsg1-2) unstable; urgency=medium

  [ Christian Göttsche ]
  * [a2fbc2f] split-protocols.patch: patch all-settings.c to successfully build twice (Closes: #1044797)

  [ Noah Meyerhans ]
  * [70e4426] Drop arm64 from libunwind builddep arch list

 -- Noah Meyerhans <noahm@debian.org>  Mon, 30 Oct 2023 13:40:35 -0700

dovecot (1:2.3.21+dfsg1-1) unstable; urgency=medium

  [ Noah Meyerhans ]
  * [753b4fe] Don't build the unmaintained lucene fts plugin (Closes: #1040884)
  * [5597486] New upstream version 2.3.21+dfsg1

  [ Christian Göttsche ]
  * [b8017f1] Cleanup temporary build files
  * [35e1afe] Silence prototype conflicts
  * [8dda8b9] Update Lintian overrides
  * [6bae82f] Bump to standards version 4.6.2 (no further changes)
  * [1f973d2] Mark hurd patch forwarded

 -- Noah Meyerhans <noahm@debian.org>  Sat, 14 Oct 2023 08:52:10 -0700

dovecot (1:2.3.20+dfsg1-1ubuntu3) mantic; urgency=medium

  * d/rules: -mbranch-protection=bti for arm64 architectures
   (LP: #2036268).

 -- Miriam España Acebal <miriam.espana@canonical.com>  Wed, 04 Oct 2023 16:33:20 +0200

dovecot (1:2.3.20+dfsg1-1ubuntu2) mantic; urgency=medium

  * d/control: Upgrade lua build dependency to 5.4

 -- Lena Voytek <lena.voytek@canonical.com>  Thu, 17 Aug 2023 09:45:33 -0700

dovecot (1:2.3.20+dfsg1-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2029440). Remaining changes:
    - d/control: Build against Lua 5.3 rather than 5.4.
      (LP #1909665)

 -- Bryce Harrington <bryce@canonical.com>  Fri, 04 Aug 2023 10:46:40 -0700

dovecot (1:2.3.20+dfsg1-1) unstable; urgency=medium

  [ Christian Göttsche ]
  * [fb2a5b7] d/rules: enable stack clash protection
  * [2666970] d/patches: bump _FORTIFY_SOURCE to level 3

  [ Noah Meyerhans ]
  * [eab5171] New upstream version 2.3.20+dfsg1
  * [d6135a4] Drop dependency on obsolete lsb-base package

 -- Noah Meyerhans <noahm@debian.org>  Sun, 25 Jun 2023 16:17:56 -0700

dovecot (1:2.3.19.1+dfsg1-2.1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2018068). Remaining changes:
    - d/control: Build against Lua 5.3 rather than 5.4.
      (LP #1909665)
  * Dropped:
    - d/rules: Package references hidden symbols during an LTO link.
      This needs further investigation.  Until then, disable LTO.
      Disable Debian's recent enablement of LTO as well,
      as it FTBFS when building with gcc 11.
      (LP #1951325)
      [Fixed in upstream commit f0c1cf42]

 -- Bryce Harrington <bryce@canonical.com>  Fri, 19 May 2023 01:47:09 +0000

dovecot (1:2.3.19.1+dfsg1-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * [b02ebc9] Don't use deprecated crypt module.
    (closes: #1028513)

 -- Bas Couwenberg <sebastic@debian.org>  Fri, 20 Jan 2023 07:01:26 +0100

dovecot (1:2.3.19.1+dfsg1-2ubuntu4) lunar; urgency=medium

  * Rebuild against latest icu

 -- Jeremy Bicha <jbicha@ubuntu.com>  Mon, 06 Feb 2023 07:33:52 -0500

dovecot (1:2.3.19.1+dfsg1-2ubuntu3) lunar; urgency=medium

  * No-change rebuild against libldap-2

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 15 Dec 2022 19:46:57 +0000

dovecot (1:2.3.19.1+dfsg1-2ubuntu2) kinetic; urgency=medium

  * d/control: Build against Lua 5.3 rather than 5.4 for kinetic

 -- Bryce Harrington <bryce@canonical.com>  Fri, 12 Aug 2022 01:08:37 +0000

dovecot (1:2.3.19.1+dfsg1-2ubuntu1) kinetic; urgency=medium

  * Merge with Debian unstable (LP: #1971273). Remaining changes:
    - d/rules: Package references hidden symbols during an LTO link.
      This needs further investigation.  Until then, disable LTO.
      Disable Debian's recent enablement of LTO as well,
      as it FTBFS when building with gcc 11.
      (LP #1951325)
  * Dropped:
    - d/p/OpenSSL3.patch: Workaround to fix EC key handling when building
      with OpenSSL 3.0.
      (LP: #1945763)
      [Fixed in Debian release 1:2.3.19+dfsg1-1]
    - privilege escalation via multiple passdbs
      + d/p/CVE-2022-30550.patch: fix handling passdbs with
        identical driver/args but different mechanisms/username_filter in
        src/auth/auth-request.c, src/auth/auth.c, src/auth/auth.h,
        src/auth/passdb.c, src/auth/passdb.h.
      [Fixed in Debian release 1:2.3.19.1+dfsg1-2]

 -- Bryce Harrington <bryce@canonical.com>  Tue, 09 Aug 2022 23:02:29 -0700

dovecot (1:2.3.19.1+dfsg1-2) unstable; urgency=medium

  [ Christian Göttsche ]
  * [281fb2c] d/patches: cherry-pick fix for CVE-2022-30550 (Closes: #1016351)
  * [9c58e71] d/patches: fix uninitialized read in doveadm-oldstats
  * [a76a24d] d/control: bump to standards version 4.6.1 (no further changes)
  * [4aaaa8b] Update Lintian overrides

 -- Noah Meyerhans <noahm@debian.org>  Fri, 29 Jul 2022 19:58:28 -0700

dovecot (1:2.3.19.1+dfsg1-1) unstable; urgency=medium

  [ Christian Göttsche ]
  * [e40f93f] d/patches: avoid usage of PATH_MAX not available on hurd
  * [19e00cd] d/rules: enable backtrace generation
  * [5bf1c43] d/patches: debug flaky unit test

  [ Noah Meyerhans ]
  * [b73422f] New upstream version 2.3.19.1+dfsg1
  * [c88bfc0] Update changelog for 1:2.3.19.1+dfsg1-1 release
  * [ca59548] Update lintian overrides
  * [d6406c2] d/copyright: update declarations for current maintainers

 -- Noah Meyerhans <noahm@debian.org>  Wed, 22 Jun 2022 09:27:01 -0700

dovecot (1:2.3.19+dfsg1-1) unstable; urgency=medium

  [ Christian Göttsche ]
  * [0d29e45] d/rules: enable LTO via DEB_BUILD_MAINT_OPTIONS instead of custom flags
  * [560cceb] d/source/lintian-overrides: update very-long-line-length-in-source-file overrides
  * [b99d09e] d/copyright: update years
  * [9ee8271] d/dovecot-core.prerm: drop as superseded by debhelper
  * [907f85c] d/maintscripts: update
  * [2b38240] d/dovecot-core.postinst: drop support for version skips
  * [dcb76d1] d/dovecot-core.postinst: only link certs if existent (Closes: #1009872)
  * [d223bbd] d/patches: add patch to support openssl 3.0 (Closes: #996273)

  [ Noah Meyerhans ]
  * [9f3175e] New upstream version 2.3.19+dfsg1

 -- Noah Meyerhans <noahm@debian.org>  Sun, 05 Jun 2022 18:29:18 +0000

dovecot (1:2.3.18+dfsg1-1) unstable; urgency=medium

  [ Noah Meyerhans ]
  * [36966c8] New upstream version 2.3.18+dfsg1
  * [042bda4] Refresh patches for 1:2.3.18+dfsg1-1

 -- "Noah Meyerhans" <noahm@debian.org>  Thu, 10 Feb 2022 20:05:50 +0000

dovecot (1:2.3.17.1+dfsg1-1) unstable; urgency=medium

  [ Christian Göttsche ]
  * [40b0010] New upstream version 2.3.17+dfsg1
  * [3c377e0] New upstream version 2.3.17.1+dfsg1
  * [e2f1ce2] d/patches: rebase and drop upstream applied ones
  * [533b7ad] d/control: bump to standards version 4.6.0 (no further changes)
  * [02ed6cf] debian: reduce Lintian issues
  * [bb3ae48] d/salsa-ci.yml: skip cross build and do not fail on Lintian
    warnings
  * [bcda7e4] d/control: build against Lua 5.4
  * [9eed0dd] d/control: enable libunwind support on available archs
  * [1990699] d/patches: cherry-pick memory leak commit
  * [426df46] d/patches: cherry-pick imapsieve fix
  * [e3d0747] d/patches: add patch for LTO by avoiding unaligned access
    (Closes: #997513)

 -- Noah Meyerhans <noahm@debian.org>  Tue, 14 Dec 2021 09:24:23 -0800

dovecot (1:2.3.16+dfsg1-3ubuntu4) kinetic; urgency=medium

  * SECURITY UPDATE: privilege escalation via multiple passdbs
    - debian/patches/CVE-2022-30550.patch: fix handling passdbs with
      identical driver/args but different mechanisms/username_filter in
      src/auth/auth-request.c, src/auth/auth.c, src/auth/auth.h,
      src/auth/passdb.c, src/auth/passdb.h.
    - CVE-2022-30550

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 11 Jul 2022 10:21:41 -0400

dovecot (1:2.3.16+dfsg1-3ubuntu3) kinetic; urgency=medium

  * No-change rebuild against libicu71

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sat, 30 Apr 2022 01:54:59 +0000

dovecot (1:2.3.16+dfsg1-3ubuntu2) jammy; urgency=medium

  * No-change rebuild for icu soname change.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 09 Feb 2022 09:13:08 +0100

dovecot (1:2.3.16+dfsg1-3ubuntu1) jammy; urgency=medium

  [ Bryce Harrington ]
  * Merge with Debian unstable. (LP: #1946855)
    Remaining changes:
    - Package references hidden symbols during an LTO link.  This needs further
      investigation.  Until then, disable LTO.
  * Dropped:
    - SECURITY UPDATE: incorrectly escapes kid and azp fields in JWT tokens
      + debian/patches/CVE-2021-29157.patch: improve escaping in
        src/lib-dict-extra/dict-fs.c, src/lib-oauth2/oauth2-jwt.c,
        src/lib-oauth2/test-oauth2-jwt.c.
      [Included in Debian 1:2.3.13+dfsg1-2]
    - SECURITY UPDATE: plaintext command injection before STARTTLS
      + debian/patches/CVE-2021-33515.patch: properly handle command queue in
        src/lib-smtp/smtp-server-cmd-starttls.c,
        src/lib-smtp/smtp-server-connection.c.
      [Included in Debian 1:2.3.13+dfsg1-2]
  * d/rules: Disable Debian's recent enablement of LTO as well, as it
    FTBFS when building with gcc 11.
    (LP: #1951325)

  [ Simon Chopin ]
  * d/p/OpenSSL3.patch: Workaround to fix EC key handling when building
    with OpenSSL 3.0.
    (LP: #1945763)

 -- Bryce Harrington <bryce@canonical.com>  Wed, 17 Nov 2021 13:46:08 -0800

dovecot (1:2.3.16+dfsg1-3) unstable; urgency=medium

  * [7b858b6] Fix FTBFS on mips(64)el.  Stacktrace generation on these
    architectures requires -funwind-tables, as with 32-bit arm.

 -- Noah Meyerhans <noahm@debian.org>  Thu, 16 Sep 2021 08:41:27 -0700

dovecot (1:2.3.16+dfsg1-2) unstable; urgency=medium

  [ Christian Göttsche ]
  * [e1e9ece] d/patches: rework backtrace test patch
  * [be404bf] d/patches: add big-endian patch

 -- Noah Meyerhans <noahm@debian.org>  Fri, 10 Sep 2021 16:10:50 -0700

dovecot (1:2.3.16+dfsg1-1) unstable; urgency=medium

  [ Christian Göttsche ]
  * [ff4a227] New upstream version 2.3.14+dfsg1
  * [963fa3b] New upstream version 2.3.15+dfsg1 (Closes: #991323, #983510)
  * [5e0c898] d/watch: adjust dversionmangle for dfsg suffix
  * [9ffb0f5] d/patches: update
  * [850e1d6] New upstream version 2.3.16+dfsg1
  * [7140b87] d/patches: rebase patches
  * [fb1b77e] d/rules: enable LTO
  * [ce7055d] d/control: add libsystemd-dev dependency
  * [db93263] d/copyright: drop unused section
  * [aeec1e8] d/rules: update how to set systemdsystemunitdir
  * [ebe9709] d/patches: resolve compiler warnings
  * [19b2bb0] d/changelog: bump to 1:2.3.16+dfsg1-1
  * [58a4078] d/patches: update 32bit warnings patch

  [ Noah Meyerhans ]
  * [f217c2e] Fix indexer crash
  * [b075317] Import upstream patch for indexer crash on client disconnect
  * [36e8740] drop debian/dovecot-core.maintscript

 -- Noah Meyerhans <noahm@debian.org>  Thu, 02 Sep 2021 13:22:16 -0700

dovecot (1:2.3.13+dfsg1-2) unstable; urgency=high

  * Import upstream fixes for security issues (Closes: #990566):
    - CVE-2021-29157: Path traversal issue allowing an attacker with
      access to the local filesystem can trick OAuth2 authentication into
      using an HS256 validation key from an attacker-controlled location
    - CVE-2021-33515: Sensitive information could be redirected to an
      attacker-controlled address because of a STARTTLS command injection
      bug in the submission service

 -- Noah Meyerhans <noahm@debian.org>  Tue, 20 Jul 2021 08:05:19 -0700

dovecot (1:2.3.13+dfsg1-1ubuntu3) impish; urgency=medium

  * No-change rebuild due to OpenLDAP soname bump.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 21 Jun 2021 17:46:46 -0400

dovecot (1:2.3.13+dfsg1-1ubuntu2) impish; urgency=medium

  * SECURITY UPDATE: incorrectly escapes kid and azp fields in JWT tokens
    - debian/patches/CVE-2021-29157.patch: improve escaping in
      src/lib-dict-extra/dict-fs.c, src/lib-oauth2/oauth2-jwt.c,
      src/lib-oauth2/test-oauth2-jwt.c.
    - CVE-2021-29157
  * SECURITY UPDATE: plaintext command injection before STARTTLS
    - debian/patches/CVE-2021-33515.patch: properly handle command queue in
      src/lib-smtp/smtp-server-cmd-starttls.c,
      src/lib-smtp/smtp-server-connection.c.
    - CVE-2021-33515

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 16 Jun 2021 09:02:15 -0400

dovecot (1:2.3.13+dfsg1-1ubuntu1) hirsute; urgency=medium

  * Package references hidden symbols during an LTO link.  This needs further
    investigation.  Until then, disable LTO.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 30 Mar 2021 17:23:55 +0200

dovecot (1:2.3.13+dfsg1-1build1) hirsute; urgency=high

  * No change rebuild against clucene-core

 -- Balint Reczey <rbalint@ubuntu.com>  Thu, 18 Feb 2021 18:19:47 +0100

dovecot (1:2.3.13+dfsg1-1) unstable; urgency=medium

  [ Christian Göttsche ]
  * [6829237] New upstream version 2.3.13 (Closes: #979363)
    - CVE-2020-24386: IMAP hibernation allows accessing other peoples mail
    - CVE-2020-25275: MIME parsing crashes with particular messages

  * [6d25736] Add libzstd-dev to build-dependencies (Closes: #969165)
  * [5956798] Rebase patches
  * [2cb63c3] Bump to standards version 4.5.1 (no further changes)
  * [548bac5] Drop unmatched copyright src/lib-ntlm/* wildcard
  * [6f33f3f] Ignore package-contains-documentation-outside-usr-share-doc
    false-positives
  * [dde9c94] Handle removed configuration file in postinst

  [ Pino Toscano ]
  * [04a60e3] d/{control,rules}: disable apparmor support on !linux archs
    (Closes: #951869)

  [ Helmut Grohne ]
  * [e5f9fcb] d/patches: improve cross-compile support (Closes: #979370)

 -- Noah Meyerhans <noahm@debian.org>  Mon, 25 Jan 2021 15:38:17 -0800

dovecot (1:2.3.11.3+dfsg1-2) unstable; urgency=medium

  [ Christian Göttsche ]
  * [44770f6] Add patch for 32bit compiler warnings
  * [053865a] Lintian: remove unused override
  * [4ece2e1] Lintian: add forwarded header to Debian specific patches
  * [67872b7] Lintian: ignore Debian only man page
  * [d30bd7e] Lintian: tag manpage-without-executable got renamed to
    spare-manual-page
  * [3bdf952] Limit libcap-dev build-dependency to linux-any
  * [28f6425] Drop acute accent in man page
  * [8c15850] Add patch allowing GSSAPI containing NULL

 -- Noah Meyerhans <noahm@debian.org>  Wed, 19 Aug 2020 12:06:07 -0700

dovecot (1:2.3.11.3+dfsg1-1) unstable; urgency=high

  * New upstream release fixes security issues (Closes: #968302)
    - CVE-2020-12100 - Receiving mail with deeply nested MIME parts leads to
      resource exhaustion as Dovecot attempts to parse it.
    - CVE-2020-12673 - Dovecot's NTLM implementation does not correctly check
      message buffer size, which leads to reading past allocation which can
      lead to crash.
    - CVE-2020-12674 - Dovecot's RPA mechanism implementation accepts
      zero-length message, which leads to assert-crash later on.
  * Add libcap-dev to build-dependencies to support dropping linux
    capabilities.

 -- Noah Meyerhans <noahm@debian.org>  Thu, 13 Aug 2020 16:21:24 -0700

dovecot (1:2.3.10.1+dfsg1-2) unstable; urgency=medium

  * Support sd_notify with systemd (Closes: #951722)
  * Add necessary CFLAGS and LDFLAGS settings to ensure functional backtrace
    generation.  (Closes: #962630)
  * Suppress additional library-not-linked-against-libc lintian warnings some
    plugins as false-positives, observed on armel systems

  [ Andreas Hasenack ]
  * d/t/control, d/t/testmails: cherry-pick updated autopkgtests from
    Ubuntu's 1:2.2.35-2ubuntu1:
    - d/t/testmails: dropped the hardcoded "Ubuntu" name from the banner
      text and made it distribution agnostic
    - d/t/control: added lsb-release to test dependencies, used to get the
      distribution name

 -- Noah Meyerhans <noahm@debian.org>  Tue, 16 Jun 2020 08:29:02 -0700

dovecot (1:2.3.10.1+dfsg1-1) unstable; urgency=medium

  * New upstream release addresses multiple security issues
    - CVE-2020-10957
    - CVE-2020-10958
    - CVE-2020-10967
    (Closes: #960963, #930919, #928492)
  * Refresh patches
  * Strip non-DFSG-compliant docs from .orig archives
  * Incorporate a number of improvements to debian/ metadata contributed by
    Christian Göttsche <cgzones@googlemail.com>
  * Move pid file to /run (Closes: #925443)
  * Add noahm@debian.org to Uploaders
  * Work around flakiness in autopkgtest suite
  * Suppress library-not-linked-against-libc lintian warnings some plugins as
    false-positives

 -- Noah Meyerhans <noahm@debian.org>  Wed, 10 Jun 2020 10:41:37 -0700

dovecot (1:2.3.7.2-1) unstable; urgency=medium

  * [dcaf24e] New upstream version 2.3.7.2
    - Fixes CVE-2019-11500 for dovecot-core
  * [111beef] Update pigeonhole to 0.5.7.2
    - Fixes CVE-2019-11500 for pigeonhole/managesieve
  * [a422c4c] Bump Standards-Version to 4.4.0; no changes needed
  * [56e37ed] Bump dh compat to 12; no changes needed.
    - Drop d/compat in favor debhelper-compat B-D.
  * [476edbd] Refresh dovecot_name.patch and ssl-cert-location.patch
  * [9dc7904] Drop patches included in 2.3.7.2.
     - CVE-2019-10691
     - CVE-2019-11494
     - CVE-2019-11499
     - CVE-2019-7524
     - avoid-double-closing-mysql.patch
     - lib-master-test-event-stats-Use-PRIu64-format.patch

 -- Apollon Oikonomopoulos <apoikos@debian.org>  Thu, 29 Aug 2019 11:55:51 +0300

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog dovecot-dev`.
