ANNOUNCE: The 6.5.0.beta7 snapshot of fetchmail is available

--===============1732953469342795130==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="Q6SF7Oq6SyiHpEiX"
Content-Disposition: inline


--Q6SF7Oq6SyiHpEiX
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

The 6.5.0.beta7 release of fetchmail is now available at
<https://downloads.sourceforge.net/project/fetchmail/branch_6.5/>.

The source archive is available at:
<https://downloads.sourceforge.net/project/fetchmail/branch_6.5/fetchmail-6=
=2E5.0.beta7.tar.xz/download>

The detached GnuPG signature is available at:
<https://downloads.sourceforge.net/project/fetchmail/branch_6.5/fetchmail-6=
=2E5.0.beta7.tar.xz.asc/download>

The SHA256 hash for the tarball is:
SHA256(fetchmail-6.5.0.beta7.tar.xz)=3D ec7c7b1af74e6cf8b4011bbe4f270796775=
e9db672a731bc68980124b91d0133

Here are the release notes:
=3D------------------------------------------------------------------------=
-------
fetchmail-6.5.0.beta7: (since .beta6):

# ADDITIONS:
* There is now a --forceidle feature to force idle mode even if not adverti=
sed
  in the server capabilities. This is a dangerous option, use it carefully.
  Courtesy of Eric Durand, GitLab merge request !39.
* rcfile parsing errors are now reported in more detail, and with -vv mode,
  also lead to a non-importable Python dump of what was obtained, for debug=
ging.

=3D------------------------------------------------------------------------=
-------
fetchmail-6.4.22...27 were merged into .beta7, highlights:

# BREAKING CHANGES:
* Since distributions continue patching for LibreSSL use, which cannot be
  linked legally, block out LibreSSL in configure.ac and socket.c, and
  refer to COPYING, unless on OpenBSD (which ships it in the base system).
  OpenSSL and wolfSSL 5 can be used.  SSL-related documentation was updated=
, do=20
  re-read COPYING, INSTALL, README, README.packaging, README.SSL.

  Note that distribution of packages linked with LibreSSL is not feasible
  due to a missing GPLv2 clause 2(b) exception.

  fetchmail can now be used with wolfSSL 5.1.1's OpenSSL compatibility laye=
r,
  see INSTALL and README.SSL. This is considered experimental.
  Feedback solicited.

# OPENSSL AND LICENSING NOTE:
* fetchmail 6.5.0 is compatible with OpenSSL 1.1.1 and 3.0.0.
  OpenSSL's licensing changed between these releases from dual OpenSSL/SSLe=
ay=20
  license to Apache License v2.0, which is considered incompatible with GPL=
 v2=20
  by the FSF.  For implications and details, see the file COPYING.

# ADDITIONS:
* Added an example systemd unit file and instructions to contrib/systemd/
  which runs fetchmail as a daemon with 5-minute poll intervals.
  Courteously contributed by Barak A. Pearlmutter, Debian Bug#981464.

# CHANGES:
* ./configure --with-ssl now supports pkg-config module names, too. See INS=
TALL.
* IMAP: When fetchmail is in not-authenticated state and the server volunte=
ers=20
  CAPABILITY information, use it and do not re-probe. (After STARTTLS, fetc=
hmail=20
  must and will re-probe explicitly.)
* fetchmail.man and README.SSL were updated in line with RFC-8314/8996/8997
  recommendations to prefer Implicit TLS (--ssl/ssl) and TLS v1.2 or newer,
  placing --sslproto tls1.2+ more prominently.
=20
# SECURITY FIXES:
* CVE-2021-39272: fetchmail-SA-2021-02: On IMAP connections, without --ssl =
and=20
  with nonempty --sslproto, meaning that fetchmail is to enforce TLS, and w=
hen=20
  the server or an attacker sends a PREAUTH greeting, fetchmail used to con=
tinue=20
  an unencrypted connection.  Now, log the error and abort the connection.
  --Recommendation for servers that support SSL/TLS-wrapped or "implicit" m=
ode on
  a dedicated port (default 993): use --ssl, or the ssl user option in an r=
cfile.
  --Reported by: Andrew C. Aitchison, based on the USENIX Security 21 paper=
 "Why=20
  TLS is better without STARTTLS - A Security Analysis of STARTTLS in the E=
mail=20
  Context" by Damian Poddebniak, Fabian Ising, Hanno B=F6ck, and Sebastian=
=20
  Schinzel.  The paper did not mention fetchmail.
* This allows STARTTLS in more scenarios, but also hardens against bypassin=
g.

# BUG FIXES:
* Fetchmail no longer crashes when attempting a connection with --plugin ""=
 or=20
  --plugout "".
* Fetchmail no longer leaks memory when processing the arguments of --plugi=
n or=20
  --plugout on connections.
* On POP3 connections, the CAPAbilities parser is now caseblind.
* Fix segfault on configurations with "defaults ... no envelope". Reported =
by =20
  Bj=F8rn Mork. Fixes Debian Bug#992400.  This is a regression in fetchmail=
 6.4.3
  and happened when plugging memory leaks, which did not account for that t=
he=20
  envelope parameter is special when set as "no envelope". The segfault hap=
pens
  in a constant strlen(-1), triggered by trusted local input =3D> no vulner=
ability.
* Fix program abort (SIGABRT) with "internal error" when invalid sslproto i=
s=20
  given with OpenSSL 1.1.0 API compatible SSL implementations.
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D

--Q6SF7Oq6SyiHpEiX
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmIcKQQACgkQ5BKxVu/z
hVop5w//ZgD2r4E7oumzNCZzIlAFYo1rMBoThm/ooscSjhkyPhPRVcwEyq9OdHdz
llfE1iim1lP9GrCFF5lqv0Zwr7r3yoxXWdII3l4p91cBdI6uALShRw89HiGJxmDA
zct/tekHQ3bU3wCgIM/OPO+QO42lfs3HJ1q0iI+1mu/J8ytvCt+D4oIAWQQ7I1Qq
k20NjvRfG3tcxvsMwKKiEqf7/WNmMbV5eyZSsCI+6mnckHgSymE3LEdLdzYMtY2q
z7ca4jWNEiNeLalF6hYBDBHN7D3JAiAceQ1YFf2Ps+/hXZAc4y2qMs9ghwqlo/Pa
SqPSiVE2ZYH+x/MJDOkcA4MeCkuQixv1roqI98Yrc1BCuNqWdC7tlrvxCVxxUDhY
8hINm8uB9EW1uI7E/sO+jh67n1kjHewvEo2oLnVsITmgsPTBZaGDQHkOat3ONKxv
NyyyvOAODGiwhZtYqmdFYi9VDLFmgLe04IVORdad7msCd5xWjGpqBA4sOqAjVEp8
nOEPCVmeAwhbPvbb6remlXPMzGj4W3JzlWfhI/8ejoG6X2+VXx3IwErIm1Nks8fa
swkAAXX75zPefxEQfE1Nr3ennXFcf0464X7LYkqhYwxlN7P/9bozzHOwUB4vRY5n
3DY1ggVj4dmGENP1qwRsW6f/Yw6XI2gIAHs6ot89vxwNRjC2t/A=
=uXXE
-----END PGP SIGNATURE-----

--Q6SF7Oq6SyiHpEiX--


--===============1732953469342795130==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============1732953469342795130==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Fetchmail-announce mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fetchmail-announce

--===============1732953469342795130==--