ANNOUNCE: The 6.4.21 release of fetchmail is available (regression fix for --logfile from 6.4.20)

--===============6491661440708103677==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="UEb+tESjGe0kOs1A"
Content-Disposition: inline


--UEb+tESjGe0kOs1A
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

The 6.4.21 release of fetchmail is now available at the usual locations,
including <https://sourceforge.net/projects/fetchmail/files/branch_6.4/>.

It contains the security fix for CVE-2021-36386 of 6.4.20, and fixes=20
a regression/a bug that causes log message truncation/run-together=20
prominently visible with --logfile that was introduced into 6.4.20.

The source archive is available at:
<https://sourceforge.net/projects/fetchmail/files/branch_6.4/fetchmail-6.4.=
21.tar.xz/download>
<https://sourceforge.net/projects/fetchmail/files/branch_6.4/fetchmail-6.4.=
21.tar.lz/download>

Detached GnuPG signatures for the respective tarballs are at:
<https://sourceforge.net/projects/fetchmail/files/branch_6.4/fetchmail-6.4.=
21.tar.xz.asc/download>
<https://sourceforge.net/projects/fetchmail/files/branch_6.4/fetchmail-6.4.=
21.tar.lz.asc/download>

SHA256 hash values for the tarballs:
SHA256(fetchmail-6.4.21.tar.lz)=3D 3abbe5f7bb003bdf3b8b71a2edd896fba55cbd3d=
19d59fe2ff8925fca4983af7
SHA256(fetchmail-6.4.21.tar.xz)=3D 6a459c1cafd7a1daa5cd137140da60c18c84b569=
9cd8e7249a79c33342c99d1d

Here are the release notes:

---------------------------------------------------------------------------=
------
fetchmail-6.4.21 (released 2021-08-09, 30042 LoC):

# REGRESSION FIX:
* The new security fix in 6.4.20 for CVE-2021-36386 caused truncation of
  messages logged to buffered outputs, predominantly --logfile.

  This also caused lines in the logfile to run into one another because
  the fragment containing the '\n' line-end character was usually lost.

  Reason is that on all modern systems (with <stdarg.h> header and vsnprint=
f()
  interface), the length of log message fragments was added up twice, so
  that these ended too deep into a freshly allocated buffer, after the '\0'
  byte.  Unbuffered outputs flushed the fragments right away, which masked =
the
  bug.

  Reported by: J=FCrgen Edner, Erik Christiansen.
---------------------------------------------------------------------------=
-----
fetchmail-6.4.20 (released 2021-07-28, 30042 LoC):

# SECURITY FIX:
* When a log message exceeds c. 2 kByte in size, for instance, with very lo=
ng=20
  header contents, and depending on verbosity option, fetchmail can crash or
  misreport each first log message that requires a buffer reallocation.
  fetchmail then reallocates memory and re-runs vsnprintf() without another=
=20
  call to va_start(), so it reads garbage. The exact impact depends on=20
  many factors around the compiler and operating system configurations used=
 and=20
  the implementation details of the stdarg.h interfaces of the two functions
  mentioned before. To fix CVE-2021-38386.

  Reported by Christian Herdtweck of Intra2net AG, T=FCbingen, Germany.
---------------------------------------------------------------------------=
------

Happy fetches,
Matthias

--UEb+tESjGe0kOs1A
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmERXAQACgkQ5BKxVu/z
hVoa3w//RgjN4AZI1Vkm5qzabtMJy8WDXcEVLRY+3/yPg8wqPcgfJNk83z3eR+cG
B8If8eHGErSl8cUf6nLtjTNOkXUmoCF8nmctnPwsWsVInEQQhs+inoxuXLvZyWEB
K4adWaaavkruKQ+4gBItRXuowGyU3STfg7/YV54XpjS2mDBYb84CIeaBGNjRtbDM
fsXwawX7B7ktyVhXMvfqVUujMtF0NeJ4hnBdYRTsn28ukjBbWLUxAJ3dK9e5PyZ2
YLW8zqs/VPNhNc9dx9yCzcGZkug0Ob8bUu5MdXdRazQ8S+zRf2XJyJV/+KdxU8Bh
+QvYjuYpSu5ZeH4zwqMEK0fSo35+DSmC1mGxfiNFpFCxeQlKabfi1J1PHhYyhpfJ
nPLsmkRW1Jyk2JkNXwO9yMq5oZ1ZHnWCZhR6MF4tzIKa+kzkmE5zC7/h7AvwvZ4s
WyK1Pr6ubAlmpsLh9tGvFGSkkq99kE2+8xLGefU8ln4JhXu3Ec7CrTUw9ZlMIB2y
WHWapd1h2+hjk3/YN21YntJqQ4p8rHpQkreYpm7aB65mp12NTv9EJH0gT3L+hNia
UvqjNPd0w9+tXHKUfaapBEfLJsGcmMEc+QUdeKrXNFTFH1oFioP35/a44q+HAi0a
diTSvJeJgXpEqyRHHiT9kibwJpa9nEpFZKlni1WfUjPSu7nVIaQ=
=Aws7
-----END PGP SIGNATURE-----

--UEb+tESjGe0kOs1A--


--===============6491661440708103677==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============6491661440708103677==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Fetchmail-announce mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fetchmail-announce

--===============6491661440708103677==--