ANNOUNCE: fetchmail 6.4.22 release candidate available (security and crash fixes)

--===============8529085487116477171==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="BQpmfcvJyfXjxWN8"
Content-Disposition: inline


--BQpmfcvJyfXjxWN8
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

The 6.4.22 release CANDIDATE of fetchmail is now available at
<https://sourceforge.net/projects/fetchmail/files/branch_6.4/>.

It contains security fixes for CVE-2021-39272 and fixes up several protocol
violations along the way, fixes some configuration-based crashes (SIGSEGV) =
and
updates the documentation.

This version has quite extensive changes for a patchlevel release.

Note that security recommendations in README.SSL were changed to achieve hi=
gher
security from the configuration. Built-in defaults do not change.

Please test this thoroughly and report your findings so we can be sure that
6.4.22 will be a good release.  It has been mailed out to the translation
project to solicit translation updates.

The source archive is available at:
<https://sourceforge.net/projects/fetchmail/files/branch_6.4/fetchmail-6.4.=
22.rc1.tar.xz/download>

Detached GnuPG signatures for the respective tarballs are at:
<https://sourceforge.net/projects/fetchmail/files/branch_6.4/fetchmail-6.4.=
22.rc1.tar.xz.asc/download>

SHA256 hash values for the tarballs:
SHA256(fetchmail-6.4.22.rc1.tar.xz)=3D 96634167a0c21673abaa8c76e669fb579926=
6c19f784c03a760c2048681cd3b3

Here are the release notes:

---------------------------------------------------------------------------=
------
fetchmail-6.4.22 (not yet released):

# SECURITY FIXES:
* On IMAP connections, without --ssl and with nonempty --sslproto, meaning =
that=20
  fetchmail is to enforce TLS, and when the server or an attacker sends=20
  a PREAUTH greeting, fetchmail used to continue an unencrypted connection.
  Now, log the error and abort the connection.
    Recommendation for servers that support SSL/TLS-wrapped or "implicit" m=
ode on
  a dedicated port (default 993): use --ssl, or the ssl user option in an r=
cfile.
    Reported by: Andrew C. Aitchison, based on the USENIX Security 21 paper=
 "Why=20
  TLS is better without STARTTLS - A Security Analysis of STARTTLS in the E=
mail=20
  Context" by Damian Poddebniak, Fabian Ising, Hanno B=F6ck, and Sebastian=
=20
  Schinzel.  The paper did not mention fetchmail.
* On IMAP and POP3 connections, --auth ssh no longer prevents STARTTLS=20
  negotiation.
* On IMAP connections, fetchmail does not permit overriding a server-side=
=20
  LOGINDISABLED with --auth password any more.
* On POP3 connections, the possibility for RPA authentication (by probing w=
ith=20
  an AUTH command without arguments) no longer prevents STARTTLS negotiatio=
n.
* For POP3 connections, only attempt RPA if the authentication type is "any=
".

# BUG FIXES:
* On IMAP connections, when AUTHENTICATE EXTERNAL fails and we have receive=
d the=20
  tagged (=3D final) response, do not send "*".
* On IMAP connections, AUTHENTICATE EXTERNAL without username will properly=
 send=20
  a "=3D" for protocol compliance.
* On IMAP connections, AUTHENTICATE EXTERNAL will now check if the server=
=20
  advertised SASL-IR (RFC-4959) support and otherwise refuse (fetchmail <=
=3D 6.4=20
  has not supported and does not support the separate challenge/response wi=
th=20
  command continuation)
* On IMAP connections, When --auth external is requested but not advertised=
 by=20
  the server, log a proper error message.
* Fetchmail no longer crashes when attempting a connection with --plugin ""=
 or=20
  --plugout "".
* Fetchmail no longer leaks memory when processing the arguments of --plugi=
n or=20
  --plugout on connections.
* On POP3 connections, the CAPAbilities parser is now caseblind.
* Fix segfault on configurations with "defaults ... no envelope". Reported =
by =20
  Bj=F8rn Mork. Fixes Debian Bug#992400.  This is a regression in fetchmail=
 6.4.3
  and happened when plugging memory leaks, which did not account for that t=
he=20
  envelope parameter is special when set as "no envelope". The segfault hap=
pens
  in a constant strlen(-1), triggered by trusted local input =3D> no vulner=
ability.

# CHANGES:
* IMAP: When fetchmail is in not-authenticated state and the server volunte=
ers=20
  CAPABILITY information, use it and do not re-probe. (After STARTTLS, fetc=
hmail=20
  must and will re-probe explicitly.)
* For typical POP3/IMAP ports 110, 143, 993, 995, if port and --ssl option
  do not match, emit a warning and continue. Closes Gitlab #31.
  (cherry-picked from 6.5 beta branch "legacy_6x")
* fetchmail.man and README.SSL were updated in line with RFC-8314/8996/8997
  recommendations to prefer Implicit TLS (--ssl/ssl) and TLS v1.2 or newer,
  placing --sslproto tls1.2+ more prominently.
  The defaults shall not change between 6.4.X releases for compatibility.
---------------------------------------------------------------------------=
------

Happy fetches,
Matthias

--BQpmfcvJyfXjxWN8
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmEoFdEACgkQ5BKxVu/z
hVrh5w/6A9DhcSjjT89DJFqoUeIsGSMuKUFTIEyHNcKqfWx7WcpY93OrD9leqUek
9Qna4RFNw6ixm0dgPD1USQBTxumP+sGeEwYXaxX3reQ6Z+f2kYBHMUIwC4bAbPvk
1FYj5zxmAIO/GrZ+wDFfRQLrBPt6wQ6eUhkzSivk2/WTrbqn8A5sBrpBXbz1mzav
sV8aApuVf3NDsnh5idF3RNdk9rVf6cZxwjjYpcWyTaSjwpsmUgnKcZd07KLnXcYm
R2XcdcuBIEiylFFj/T2NT2Q/lAlviYsH/eoTCM7+2mZyBAP8/kohf8a3hzf9neB3
ZBR+4MiSW7UTlRdVyMxBBfkv90xSEUdPL/hFEubgG4vuHQhlpxtt9hgVcL8Bpxmb
g9X5y6mC5dh9XcilBLbzCruThzr5v3EiuA8vb3fxuurbyQQxIyOVw4d45gNCxQ2R
SJjxKyOg4knSjGmuulq9W87i5KKmtXHcIz/iitHtJCyx8APhLf66BM5Iem0LsjL9
28H0qYe5f9lV0JlKmkGSc2Go8iw4NK9bp4axtFWSInXJQJNxj0BmJePFKS1WngTP
W0YodYQ7gsEjBmlIggSskNC60Sk91gQvDmTEjGxMxM5RbKWaP3qp080giQ3iIxJ/
v7c8EE7Gfcyh4j6jIA/U4p9+TRDYGGximwiaKCpK4yNSR7Z/+U0=
=zNVI
-----END PGP SIGNATURE-----

--BQpmfcvJyfXjxWN8--


--===============8529085487116477171==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============8529085487116477171==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Fetchmail-announce mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fetchmail-announce

--===============8529085487116477171==--