ANNOUNCE: The 6.5.7.rc2 release candiate of fetchmail is available (SMTP AUTH fixes & .netrc support - NO (START)TLS yet)

--===============8929452890036751617==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="9ZG64NhpFWWt/dYv"
Content-Disposition: inline


--9ZG64NhpFWWt/dYv
Content-Type: multipart/mixed; boundary="ARauoqbsmRLxcIzn"
Content-Disposition: inline


--ARauoqbsmRLxcIzn
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

The 6.5.7.rc2 release candidate of fetchmail is now available at the=20
usual locations, including
<https://downloads.sourceforge.net/project/fetchmail/branch_6.5/>.


Changes are listed below, but I have added wolfSSL and GSSAPI support to
meson-based builds.  I'd be happy to receive reports from people building w=
ith
meson if that works for you or if not, where not, how not.

I have not added all the tiny disable options to meson we used to have in
configure.ac, the POP3/IMAP features take 10...12 kByte on AMD64, and the
ETRN/ODMR less than 3 kByte each, in a 280 kByte sized executable.


The source archive is available at:
<https://downloads.sourceforge.net/project/fetchmail/branch_6.5/fetchmail-6=
=2E5.7.rc2.tar.xz/download>

The detached GnuPG signature is available at:
<https://downloads.sourceforge.net/project/fetchmail/branch_6.5/fetchmail-6=
=2E5.7.rc2.tar.xz.asc/download>

The SHA256 hashes for the tarballs are:
SHA2-256(fetchmail-6.5.7.rc2.tar.xz)=3D 6b0a5aa50316b894b493c69e9c7c9ad5d80=
47df4703f483e97ed0a22a509172d

Note I have moved the tag after pushing it for the first time; it was on 68=
6b6 first where I hadn't
committed the NEWS, configure.ac and meson.build file's bump to rc2 and cre=
diting Besnik for the Shqip
(Albanian) translation, but the tarballs had already been built with the co=
ntents of what's now fd34e417.

Log since rc1: (newest first)
--------------
* fd34e417 2025-10-13 | Prepare 6.5.7.rc2. (tag: 6.5.7.rc2) [Matthias Andre=
e]
* 686b6f64 2025-10-12 | Update <sq> Albanian translation to fetchmail-6.5.6=
 [Besnik Bleta]
* a46c2f3f 2025-10-12 | Support GSSAPI in meson builds. [Matthias Andree]
* 9dec1279 2025-10-11 | Support wolfSSL in meson builds. [Matthias Andree]
* 0ca08c94 2025-10-11 | Strip OPIE, add meson instructions [Matthias Andree]
* 29195d28 2025-10-11 | Fix LOCALEDIR for meson builds. [Matthias Andree]
* d9d4235a 2025-10-10 | NEWS: remove angle brackets from MAIL FROM:<> [Matt=
hias Andree]
* 97765dff 2025-10-10 | Fix GNU tar --mtime argument when SOURCE_DATE_EPOCH=
 is set. [Matthias Andree]


Here are the release notes:
---------------------------------------------------------------------------=
-----
fetchmail-6.5.7 (not yet released):

## BUGFIX:
* When authenticating to an SMTP server, the AUTH LOGIN method (which didn't
  become a proposed standard, and is only the third method fetchmail would =
try,
  if CRAM-MD5 and PLAIN weren't offered) required that the server returned
  a 334 code followed by a blank and by a decodable base64 challenge we ign=
ored
  anyways.  This is in line with RFC 4952.
    However, to improve compatibility, fetchmail now accepts anything that
  starts with "334 " and disregards the remainder of the line.
  At the same time, AUTH LOGIN was deprecated. AUTH PLAIN should be availab=
le
  everywhere AUTH LOGIN is, and is specified in IETF RFC 4616.
* When authenticating to an SMTP server, i. e. esmtpname/esmtppassword are
  defined, check for errors, and skip servers that do not understand EHLO,
  because we cannot negotiate supported authentication schemes with them.
  This should avoid attempting to send a lot of messages and see them rejec=
ted.
* When authenticating to an SMTP server, do not send client abort "*" when
  we receive any other server reply but 334.
* Extend 6.5.6's RFC-5321 address-literal fix to MAIL FROM. This might
  apply when we only have a server's IP address and need to quality
  addresses without domain. Fixes Debian Bug#1080025.
* SMTP AUTH can now look up passwords from the .netrc file - for that,
  fetchmail's esmtpname setting must match the login for the given host in
  .netrc. Fixes Debian Bug#1056651 by Ticker Berkin.

## TRANSLATION UPDATES were contributed by these fine people - thank you!
* cs:    Petr Pisar [Czech]
* eo:    Keith Bowes [Esperanto]
* es:    Cristian Oth=F3n Mart=EDnez Vera [Spanish]
* fr:    Fr=E9d=E9ric Marchal [French]
* ja:    Takeshi Hamasaki [Japanese]
* pl:    Jakub Bogusz [Polish]
* ro:    Remus-Gabriel Chelu [Romanian]
* sq:    Besnik Bleta [Albanian]
* sv:    G=F6ran Uddeborg [Swedish]

---------------------------------------------------------------------------=
----


--ARauoqbsmRLxcIzn
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=fetchmail-SA-2025-01.txt
Content-Transfer-Encoding: quoted-printable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

fetchmail-SA-2025-01: SMTP AUTH denial of service

Topics:		fetchmail SMTP client can crash when authenticating

Author:		Matthias Andree
Version:	1.0
Announced:	2025-10-03
Type:		failure to validate network input in certain configurations
Impact:		fetchmail tries to read from address 1 and can crash
Severity:	moderate

URL:		https://www.fetchmail.info/fetchmail-SA-2025-01.txt
Project URL:	https://www.fetchmail.info/
CVE Name:	pending, requested via MITRE as CNA-LR

Affects:	- fetchmail releases up to and including 6.5.5
		- fetchmail 7.0.0 pre-releases

Not affected:	- fetchmail 6.5 releases 6.5.6 and newer

Introduced in:	2002-03-09 fetchmail release 5.9.9 added SMTP AUTH

Corrected in:	2025-10-03 Git commit 4c3cebfa4e659fb778ca2cae0ccb3f69201609a8
		2025-10-03 fetchmail release 6.5.6


1. Background
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

fetchmail is a software package to retrieve mail from remote POP3, IMAP,
ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.

fetchmail defaults to using the SMTP server on "localhost"
and to not attempting to authenticate, unless configured otherwise.

fetchmail also supports a "daemon" mode, where it runs over extended time
and periodically polls the upstream servers.  This can detach fetchmail
=66rom the controlling terminal into the background, or - with a "nodetach"=
 setting
- - keep attached to the controlling terminal, which also eases use by
service supervisors.


2. Problem description and Impact
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D

fetchmail's SMTP client, when configured to authenticate [1], is susceptible
to a protocol violation where, when a trusted but malicious or malfunctioni=
ng
SMTP server responds to an authentication request with a "334" code but wit=
hout a
following blank on the line, it will attempt to start reading from memory
address 0x1 to parse the server's SASL challenge. This address is constant =
and not
under the attacker's control. This event will usually cause a crash of fetc=
hmail.
  If fetchmail in this situation was running in daemon mode, this mode is a=
lso
terminated by the crash.

[1] This requires the esmtpname and esmtppassword options to be configured =
in
the configuration file and the plugout and mda options to be inactive.

As a word of warning, this vulnerability has eluded several static code ana=
lyzers.


3. Solutions
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

General recommendation: if running fetchmail in the background or in daemon
mode, ensure that the daemon is supervised and crashes are reported so that
action can be taken about the malfunctioning SMTP server, or on fetchmail's=
 end
to replace local delivery by different server or other means.


3a. Install fetchmail 6.5.6 or newer.

The fetchmail source code is available from
<https://sourceforge.net/projects/fetchmail/files/> and
<https://gitlab.com/fetchmail/fetchmail/-/releases>

The Git-based source code repository is currently published via
https://gitlab.com/fetchmail/fetchmail/-/tree/legacy_6x (primary)
https://sourceforge.net/p/fetchmail/git/ci/legacy_6x/tree/ (copy)


3b. Apply the smtp.c patch from the URL below and rebuild fetchmail:
<https://gitlab.com/fetchmail/fetchmail/-/commit/4c3cebfa4e659fb778ca2cae0c=
cb3f69201609a8>


A. Copyright, License and Non-Warranty
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

(C) Copyright 2025 by Matthias Andree, <[email protected]>.
Some rights reserved.

This file is licensed under CC BY-ND 4.0. To view a copy of this license,
visit <http://creativecommons.org/licenses/by-nd/4.0/>

THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.

END of fetchmail-SA-2025-01
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmjfuj8ACgkQ5BKxVu/z
hVoXfRAApBdTub7EDpczbGlHfuqM96xFFRXHahETtL3sPSTNf+EB5CpBH+t5wV2M
zeYcdbYLgf0X/nT8+ua2lyP8c5YW5OOntINa49HOwYhTnIf/Msju4NS9RExigOxM
xpUAFNO8Mci79q7NWxrNJkOZIy5OfM1cTxXfECbibWjg2MsbZj7BaJu3EdkEmpOp
bzKBbL87Fv3dfYYvrRgBeJo7jvl9PqqNgY+WtBSC4lkHKstA0QaEYvkZDzQW4pwC
ZUQASWpDHEQTU5VSaKNXEMy3g9nqmLtMBx66VH8Gzv/dh73x5rouiExKQIjKBMxD
LUkibZ2iQOQR2gETd/QwtY98W5KGCW5pjVdIV2SJsoPOte0OEaMI5aersREmI52O
R++3dmOeKbT/DW6SGCvY8xGKXqCfQfQy66XY3/ZXBpE7xJITGEzjiYqOv7Tt5L8E
3VKCRC/MVbkrPF8Hnh9It75OdxO6v1gG/GNBOStiHVU6cOhPQmwykhTug4UjfOzZ
0n6c5DNk7Lz3m1AjWHIGgO7v0rHWibH5rw3ksBQi0X3OSv4xqrSTHsQz0WV+l3KS
q98e0GtG5g/aKQL1EWp+/VNXjrhm3I+Wg+haR3zJ/PcTdxEfpaXW4RUTsK2MAxvm
1HPZuyhLFpgsptFGvPbJONUnah/OWttaPCfrM5neP9wZzPHLnjs=3D
=3DSu9H
-----END PGP SIGNATURE-----

--ARauoqbsmRLxcIzn--

--9ZG64NhpFWWt/dYv
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmjtNhwACgkQ5BKxVu/z
hVqKTw//Z4qJISkWdQcHRwri+G9aefFbaF9dQOvh+qqgWK2ufapn1lsoymnC3pzB
1LnYnCeNttL38knes++dMPGjoeMQt/Y+v/agkE3pCqTdkBWBKeflkxRiCnlC2JnX
G4ec/5uTWtB/kR+umifsdAkXIvhZHPDPf0moQYp4IRJzW/8GOiy/9gxRWR3csMvg
fICLnuKQ0BJwr2sdaSvNJZoVQCZDZ4//z9btSJlAlihemffp/EXhleRn9wPjwFO9
fKnqXa7vuLvz1M0U/2Fu0ZcfBqUXFpMp1wIdcEAzisnptEvoV1SwGvwpekzUwtCi
a5Pcclo4TivStCH0gcdycUkSa4raeNCPBRKmwQ7UKv7+ptoxf/RUDMAtZWz5u4ON
P7wzKOrt+8EYI4mJSfrpPdT+t3d8QYhUd2264gPAU73u4bgRNbFjbUtl10rT1gRN
6nH6pLCkDblgikpI9D7jHHXyIhHrHa/1DmQygKke37vd/PdSt1IEIkFzW3KY2UU6
A46SW8OGcwYN+xAb0AZQeDPHoTQ+3jQvpV5KulN+eIZVgBuh7TA/bQrzMKGmok/w
8OBqu8uqLypyb6ll+XNSce3yU8ae36tjgXdckKqkQx59Vvdz9PrfUmC/2U0TwEbx
FqqDtKTlDW879wwHlQRy3PnsAiiTZyw+EGydlCd1Pyz0jbXQ9Ck=
=IoO2
-----END PGP SIGNATURE-----

--9ZG64NhpFWWt/dYv--


--===============8929452890036751617==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============8929452890036751617==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Fetchmail-announce mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fetchmail-announce

--===============8929452890036751617==--