The 6.6.5 security fix release of fetchmail is available (fixes RPA buffer sizing)

--===============6795975385229600693==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="eYDk7oXLcQmsnX3R"
Content-Disposition: inline


--eYDk7oXLcQmsnX3R
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

The 6.6.5 release of fetchmail is now available at the usual locations,
including <https://downloads.sourceforge.net/project/fetchmail/branch_6.6/>.

The source archive is available at:
<https://downloads.sourceforge.net/project/fetchmail/branch_6.6/fetchmail-6.6.5.tar.xz/download>

The detached GnuPG signature is available at:
<https://downloads.sourceforge.net/project/fetchmail/branch_6.6/fetchmail-6.6.5.tar.xz.asc/download>

The SHA256 hashes for the tarballs are:
SHA2-256(fetchmail-6.6.5.tar.xz)= ab0320fe4df0b5ee8659189e66590d9de96aadbf929fe59f353ae7a317e9ef1e


Here are the release notes:
--------------------------------------------------------------------------------
fetchmail-6.6.5 (released 2026-06-17, 32433 LoC):

## SECURITY BUGFIX
* POP3 with RPA: fix calculation of buffer sizes to avoid buffer overflow
  on long service challenges with long user IDs, which would smash our stack.
    Triggering this requires that 1. RPA is enabled at compile time
  (non-default, which is discouraged in autotools, and possible but not
  documented nor supported in meson), and the username (--user option, or user
  in the rcfile) contains @compuserve.com anywhere, and the server supports an
  AUTH command without arguments (which is a non-standard local extension), and
  that it offers RPA authentication in response to that command.

  This was reported based on an incomplete semi-wrong AI report with an
  incomplete fix "recommendation" by [email protected] via
  fetchmail-devel@.  The fix suggested in that AI report was wrong, and
  would happily crash a few lines later again.  The fix deployed calculates
  the buffer size of "workarea" variables based on the sizeof() of constituent
  components.

## BUGFIX
* Robustness: If RPA is enabled at compile time and POP3 is in use,
  do not barf if @compuserve.com is in the remote site's username (what you'd
  pass as --user, or user in the rcfile) and the remote site either does not
  support an "AUTH" command without parameters (normally, one is required, but
  some servers such as jpop and Cyrus allow AUTH to request the list of
  supported authentication types as an extension; the standard way would be
  a "CAPA" request instead), but try other authentication methods.
  Found by code auditing in response to a bug report against rpa.c.
  Note that enabling RPA is discouraged because it is based on the weak
  MD5 crypto algorithm.

-------------------------------------------------------------------------------

--eYDk7oXLcQmsnX3R
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmozD7oACgkQ5BKxVu/z
hVqb/BAAufk9E0KPyoXrqJXIH9udi1a6D/RHGZJsnF7cHhfKUsftWxLaZ/yvxrZL
jBkQSL2OBOqnftGTO5NlrriGQSUfFHHhfsO5PPlRnFk70t2L9rRWBiJ7RIPt0eco
4e/AlHwwMUn4VXjwSUaH9rJsXJlpu21ACW7IcM4Njyxank3FUREgjQpGOIuh1AU6
pGNlH8niRwRCrpXOHfKjA5uX5n/OtSNMg5fX4J3S6vVUoqlJp/4mPIbaAT6J+bB3
DWeEkIWeYqdtCwENEXl+JX2IX++PC7aix+bz46Ku/UOwEPIck6jcCAXFrGkyTUFO
19RGe9LTxM4tGp+fVBmyf5RUPPwwNitvcXeFss0UoLzbxaQEz2IulmNTlSVIa2x7
vz7J0CwIGKlDOdvGOZrQqJy8IQoZ7v4EuIjT90dzECir7LRku+iawvhiNpDivO5o
5f9TC4bIvbU9YmYCcV5m44B/zSEjvJ6G2s4ixjdR/JZC6UavnxRYujR66KQ7U3yz
HZGF6bCtbd+GEIAKfEo0usWEPgbW/PaPVpeuJ4ILZJi96Eoo2iear6zbibEa6jS3
YbLOzPApqC8wBmKII5t2A1f8mnf6P6dTW42VgSjytguUuGU0R0yZ8v+jp25kCSy6
wMieIee0fgUit/Co7NIdlL6B0huWlWabQZwM/XcyLHwdbVFE+io=
=Kino
-----END PGP SIGNATURE-----

--eYDk7oXLcQmsnX3R--


--===============6795975385229600693==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============6795975385229600693==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Fetchmail-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fetchmail-users

--===============6795975385229600693==--