ANNOUNCE: fetchmail 6.5.6 SECURITY FIX released and fetchmail-SA-2025-01.txt security announcement (fix for SMTP AUTH potential crash, other bugfixes)

--===============4405714388026903964==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="4XZxxpjrsCDc3P/p"
Content-Disposition: inline


--4XZxxpjrsCDc3P/p
Content-Type: multipart/mixed; boundary="SUxN+U9G/f89DKsK"
Content-Disposition: inline


--SUxN+U9G/f89DKsK
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

The 6.5.6 release of fetchmail is now available at the usual locations,
including <https://downloads.sourceforge.net/project/fetchmail/branch_6.5/>.

The source archive is available at:
<https://downloads.sourceforge.net/project/fetchmail/branch_6.5/fetchmail-6.5.6.tar.xz/download>

The detached GnuPG signature is available at:
<https://downloads.sourceforge.net/project/fetchmail/branch_6.5/fetchmail-6.5.6.tar.xz.asc/download>

The SHA256 hashes for the tarballs are:
SHA2-256(fetchmail-6.5.6.tar.xz)= ec10e0e0eaa417313559379ede76c74614766d838b39470b66474863aa690dab


Here are the release notes:
--------------------------------------------------------------------------------
fetchmail-6.5.6 (released 2025-10-03, 31795 LoC):

## SECURITY BUGFIX:
* fetchmail-SA-2025-01.txt: CVE pending assignment by MITRE
  An SMTP server advertising EHLO and AUTH, and if fetchmail is configured to
  authenticate (esmtpname and esmtppassword given and non-empty), the server
  might crash fetchmail by sending a "334" response without further blank to
  fetchmail's AUTH request. This is in violation of applicable RFC-4952 though.
    Fetchmail now detects this situation and reports it separately as
  malformed server reply.
    Fetchmail 6.5.6 has been released without waiting for translation updates
  or CVE identifier, these will be provided in followup releases.

## BUGFIXES:
* RFC-5321: When the --smtpaddress, --smtphost, --smtpname, -D or -S argument
  is an numeric address literal such as 192.0.2.2 or 2001:0DB8::4321, properly
  format that as such in the SMTP RCPT command as user@[192.0.2.2] or
  user@[IPv6:2001:0DB8::4321].
* When printing output on the console while fetching mail, do not intersperse
  another copy of our program name and date in the middle of a log line.

  Workaround for older versions: --logfile /dev/tty  (might also use
  --logfile /dev/stderr) - but note this changes buffering behavior and may
  output to appear later and without ticker marks.
* A few low-priority memory leaks in the command-line options parser were
  fixed. Since this parser runs only once, leaks are harmless.
* Some minor code cleanups and robustness fixes were made, and we should
  see fewer compiler warnings as a result.

## CHANGES:
* Given the slow update schedules of some distributions, already add code
  that checks if time_t() is good beyond the year 2038,
  meaning time_t is either unsigned (which would last until 2106) or
  64 bits wide.  If the system isn't safe, warn on every launch of fetchmail
  beginning 2028-01-01 at 00:00 GMT so users have 10 years to plan.
  Fetchmail will also print a warning if time(time_t *t) overflows.

-------------------------------------------------------------------------------

--SUxN+U9G/f89DKsK
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=fetchmail-SA-2025-01.txt
Content-Transfer-Encoding: quoted-printable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

fetchmail-SA-2025-01: SMTP AUTH denial of service

Topics:		fetchmail SMTP client can crash when authenticating

Author:		Matthias Andree
Version:	1.0
Announced:	2025-10-03
Type:		failure to validate network input in certain configurations
Impact:		fetchmail tries to read from address 1 and can crash
Severity:	moderate

URL:		https://www.fetchmail.info/fetchmail-SA-2025-01.txt
Project URL:	https://www.fetchmail.info/
CVE Name:	pending, requested via MITRE as CNA-LR

Affects:	- fetchmail releases up to and including 6.5.5
		- fetchmail 7.0.0 pre-releases

Not affected:	- fetchmail 6.5 releases 6.5.6 and newer

Introduced in:	2002-03-09 fetchmail release 5.9.9 added SMTP AUTH

Corrected in:	2025-10-03 Git commit 4c3cebfa4e659fb778ca2cae0ccb3f69201609a8
		2025-10-03 fetchmail release 6.5.6


1. Background
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

fetchmail is a software package to retrieve mail from remote POP3, IMAP,
ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.

fetchmail defaults to using the SMTP server on "localhost"
and to not attempting to authenticate, unless configured otherwise.

fetchmail also supports a "daemon" mode, where it runs over extended time
and periodically polls the upstream servers.  This can detach fetchmail
=66rom the controlling terminal into the background, or - with a "nodetach"=
 setting
- - keep attached to the controlling terminal, which also eases use by
service supervisors.


2. Problem description and Impact
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D

fetchmail's SMTP client, when configured to authenticate [1], is susceptible
to a protocol violation where, when a trusted but malicious or malfunctioni=
ng
SMTP server responds to an authentication request with a "334" code but wit=
hout a
following blank on the line, it will attempt to start reading from memory
address 0x1 to parse the server's SASL challenge. This address is constant =
and not
under the attacker's control. This event will usually cause a crash of fetc=
hmail.
  If fetchmail in this situation was running in daemon mode, this mode is a=
lso
terminated by the crash.

[1] This requires the esmtpname and esmtppassword options to be configured =
in
the configuration file and the plugout and mda options to be inactive.

As a word of warning, this vulnerability has eluded several static code ana=
lyzers.


3. Solutions
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

General recommendation: if running fetchmail in the background or in daemon
mode, ensure that the daemon is supervised and crashes are reported so that
action can be taken about the malfunctioning SMTP server, or on fetchmail's=
 end
to replace local delivery by different server or other means.


3a. Install fetchmail 6.5.6 or newer.

The fetchmail source code is available from
<https://sourceforge.net/projects/fetchmail/files/> and
<https://gitlab.com/fetchmail/fetchmail/-/releases>

The Git-based source code repository is currently published via
https://gitlab.com/fetchmail/fetchmail/-/tree/legacy_6x (primary)
https://sourceforge.net/p/fetchmail/git/ci/legacy_6x/tree/ (copy)


3b. Apply the smtp.c patch from the URL below and rebuild fetchmail:
<https://gitlab.com/fetchmail/fetchmail/-/commit/4c3cebfa4e659fb778ca2cae0c=
cb3f69201609a8>


A. Copyright, License and Non-Warranty
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

(C) Copyright 2025 by Matthias Andree, <[email protected]>.
Some rights reserved.

This file is licensed under CC BY-ND 4.0. To view a copy of this license,
visit <http://creativecommons.org/licenses/by-nd/4.0/>

THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.

END of fetchmail-SA-2025-01
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmjfuj8ACgkQ5BKxVu/z
hVoXfRAApBdTub7EDpczbGlHfuqM96xFFRXHahETtL3sPSTNf+EB5CpBH+t5wV2M
zeYcdbYLgf0X/nT8+ua2lyP8c5YW5OOntINa49HOwYhTnIf/Msju4NS9RExigOxM
xpUAFNO8Mci79q7NWxrNJkOZIy5OfM1cTxXfECbibWjg2MsbZj7BaJu3EdkEmpOp
bzKBbL87Fv3dfYYvrRgBeJo7jvl9PqqNgY+WtBSC4lkHKstA0QaEYvkZDzQW4pwC
ZUQASWpDHEQTU5VSaKNXEMy3g9nqmLtMBx66VH8Gzv/dh73x5rouiExKQIjKBMxD
LUkibZ2iQOQR2gETd/QwtY98W5KGCW5pjVdIV2SJsoPOte0OEaMI5aersREmI52O
R++3dmOeKbT/DW6SGCvY8xGKXqCfQfQy66XY3/ZXBpE7xJITGEzjiYqOv7Tt5L8E
3VKCRC/MVbkrPF8Hnh9It75OdxO6v1gG/GNBOStiHVU6cOhPQmwykhTug4UjfOzZ
0n6c5DNk7Lz3m1AjWHIGgO7v0rHWibH5rw3ksBQi0X3OSv4xqrSTHsQz0WV+l3KS
q98e0GtG5g/aKQL1EWp+/VNXjrhm3I+Wg+haR3zJ/PcTdxEfpaXW4RUTsK2MAxvm
1HPZuyhLFpgsptFGvPbJONUnah/OWttaPCfrM5neP9wZzPHLnjs=3D
=3DSu9H
-----END PGP SIGNATURE-----

--SUxN+U9G/f89DKsK--

--4XZxxpjrsCDc3P/p
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmjf0j4ACgkQ5BKxVu/z
hVoRXg/+O9cUzW/1CFw6CctOwCc4mNOqsiJyNHlfMUAc/XblOjUdCQTM2KnAUQIM
eEhCAI/d4g9EFN9hAkeLn9tZ6P2nxsbML0C3N8ekp+vi8igT9r+LzKgirkRY7zFu
hGbYKEXrey1dca829dDcizaeYNtFIkAgGQXd2LYq1PPQTCU6CpVmxUlHEkaB9iAA
NNrT1zxHzyGyZXplLxp5lSMMxJbR1FI0P3XuP78dXr66/MH4UASdMhxfSadvpPqN
XRabvp6b8npvu+C/niTuyXJ/7dotBh2ZBt1uGmK6RCwd6iyHh7N2phd7eD/Y0sXZ
y4Y/qaNY/einj2HKdUwLDDkEj7OhxgC58Nsh1n3u1RBGXmZ3wHvsFxJEEk/Xr5sk
SgiEEkQ7IuqUwYx3m5tLRUOkHCTJy/YUofEH7Td9HUuhrRKw/BISVaHp4xjY6os2
gmFTQUwCZcqfqpv5xMAmu436WkMieYUEkw43hcnLp7p/drIYLYdQO0a78gc9704N
2U0hutupVReZJ/1psobh5LS+x0S+k8esYJCGSFUMaoOPrka9euCozC6pBK8R3a1n
GhdGLOX45PF7djhQALnFmGe58Hr998axVLjbzeeKk4kIse9Bv/qexhkZpdow47UR
V7c/G8nY7gr/9x7pH1/Yo+svlkBKjYfP3zhJQv+QEGpzf0u+N7s=
=IIuk
-----END PGP SIGNATURE-----

--4XZxxpjrsCDc3P/p--


--===============4405714388026903964==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============4405714388026903964==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Fetchmail-announce mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fetchmail-announce

--===============4405714388026903964==--