SASL 2.1.27
Ken Murchison <[email protected]> Tue, 20 Nov 2018 10:00:56 -0500
| Newsgroups | gmane.mail.imap.cyrus.announce,gmane.comp.security.cyrus.sasl,gmane.mail.imap.cyrus |
|---|---|
| Organization | FastMail US LLC |
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------C2B8F1E264E309E75A904346
Content-Type: multipart/alternative;
boundary="------------1870FEFCC47509D62C89D4A4"
--------------1870FEFCC47509D62C89D4A4
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
All,
I'm pleased to announce the release of the long-awaited SASL 2.1.27
which can be downloaded from here:
* HTTP:
https://www.cyrusimap.org/releases/cyrus-sasl-2.1.27.tar.gz
https://www.cyrusimap.org/releases/cyrus-sasl-2.1.27.tar.gz.sig
* FTP:
ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-2.1.27.tar.gz
ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-2.1.27.tar.gz.sig
md5sum:
a33820c66e0622222c5aefafa1581083 cyrus-sasl-2.1.27.tar.gz
b295313b9915be32b334f7e88f30dacd cyrus-sasl-2.1.27.tar.gz.sig
The (mostly) complete list of changes from 2.1.26 are these:
* Added support for OpenSSL 1.1
* Added support for lmdb (from Howard Chu)
* Lots of build fixes (from Ignacio Casal Quinteiro and others)
* Treat SCRAM and DIGEST-MD5 as more secure than PLAIN when selecting
client mech
* DIGEST-MD5 plugin:
o Fixed memory leaks
o Fixed a segfault when looking for non-existent reauth cache
o Prevent client from going from step 3 back to step 2
o Allow cmusaslsecretDIGEST-MD5 property to be disabled
* GSSAPI plugin:
o Added support for retrieving negotiated SSF
o Properly compute maxbufsize AFTER security layers have been set
* SCRAM plugin:
o Added support for SCRAM-SHA-256
o Allow SCRAM-* to be used by HTTP
* LOGIN plugin:
o Don’t prompt client for password until requested by server
* NTLM plugin:
o Fixed crash due to uninitialized HMAC context
* saslauthd:
o cache.c:
+ Don’t use cached credentials if timeout has expired
+ Fixed debug logging output
o ipc_doors.c:
+ Fixed potential DoS attack (from Oracle)
o ipc_unix.c:
+ Prevent premature closing of socket
o auth_rimap.c:
+ Added support LOGOUT command
+ Added support for unsolicited CAPABILITY responses in LOGIN
reply
+ Properly detect end of responses (don’t needlessly wait)
+ Properly handle backslash in passwords
o auth_httpform:
+ Fix off-by-one error in string termination
+ Added support for 204 success response
o auth_krb5.c:
+ Added krb5_conv_krb4_instance option
+ Added more verbose error logging
--
Ken Murchison
Cyrus Development Team
FastMail US LLC
--------------1870FEFCC47509D62C89D4A4
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>All,</p>
<p>I'm pleased to announce the release of the long-awaited SASL
2.1.27 which can be downloaded from here:<br>
</p>
<pre class="moz-quote-pre" wrap="">
* HTTP:
<a class="moz-txt-link-freetext" href="https://www.cyrusimap.org/releases/cyrus-sasl-2.1.27.tar.gz">https://www.cyrusimap.org/releases/cyrus-sasl-2.1.27.tar.gz</a>
<a class="moz-txt-link-freetext" href="https://www.cyrusimap.org/releases/cyrus-sasl-2.1.27.tar.gz.sig">https://www.cyrusimap.org/releases/cyrus-sasl-2.1.27.tar.gz.sig</a>
* FTP:
<a class="moz-txt-link-freetext" href="ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-2.1.27.tar.gz">ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-2.1.27.tar.gz</a>
<a class="moz-txt-link-freetext" href="ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-2.1.27.tar.gz.sig">ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-2.1.27.tar.gz.sig</a>
md5sum:
a33820c66e0622222c5aefafa1581083 cyrus-sasl-2.1.27.tar.gz
b295313b9915be32b334f7e88f30dacd cyrus-sasl-2.1.27.tar.gz.sig
</pre>
<br>
<p>The (mostly) complete list of changes from 2.1.26 are these:</p>
<ul class="simple">
<li>Added support for OpenSSL 1.1</li>
<li>Added support for lmdb (from Howard Chu)</li>
<li>Lots of build fixes (from Ignacio Casal Quinteiro and others)</li>
<li>Treat SCRAM and DIGEST-MD5 as more secure than PLAIN when
selecting client mech</li>
<li>DIGEST-MD5 plugin:
<ul>
<li>Fixed memory leaks</li>
<li>Fixed a segfault when looking for non-existent reauth
cache</li>
<li>Prevent client from going from step 3 back to step 2</li>
<li>Allow cmusaslsecretDIGEST-MD5 property to be disabled</li>
</ul>
</li>
<li>GSSAPI plugin:
<ul>
<li>Added support for retrieving negotiated SSF</li>
<li>Properly compute maxbufsize AFTER security layers have
been set</li>
</ul>
</li>
<li>SCRAM plugin:
<ul>
<li>Added support for SCRAM-SHA-256</li>
<li>Allow SCRAM-* to be used by HTTP<br>
</li>
</ul>
</li>
<li>LOGIN plugin:
<ul>
<li>Don’t prompt client for password until requested by server</li>
</ul>
</li>
<li>NTLM plugin:
<ul>
<li>Fixed crash due to uninitialized HMAC context</li>
</ul>
</li>
<li>saslauthd:
<ul>
<li>cache.c:
<ul>
<li>Don’t use cached credentials if timeout has expired</li>
<li>Fixed debug logging output</li>
</ul>
</li>
<li>ipc_doors.c:
<ul>
<li>Fixed potential DoS attack (from Oracle)</li>
</ul>
</li>
<li>ipc_unix.c:
<ul>
<li>Prevent premature closing of socket</li>
</ul>
</li>
<li>auth_rimap.c:
<ul>
<li>Added support LOGOUT command</li>
<li>Added support for unsolicited CAPABILITY responses in
LOGIN reply</li>
<li>Properly detect end of responses (don’t needlessly
wait)</li>
<li>Properly handle backslash in passwords</li>
</ul>
</li>
<li>auth_httpform:
<ul>
<li>Fix off-by-one error in string termination</li>
<li>Added support for 204 success response</li>
</ul>
</li>
<li>auth_krb5.c:
<ul>
<li>Added krb5_conv_krb4_instance option</li>
<li>Added more verbose error logging</li>
</ul>
</li>
</ul>
</li>
</ul>
<p> </p>
<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
Ken Murchison
Cyrus Development Team
FastMail US LLC</pre>
</body>
</html>
--------------1870FEFCC47509D62C89D4A4--
--------------C2B8F1E264E309E75A904346
Content-Type: text/x-vcard;
name="murch.vcf"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="murch.vcf"
bnVsbA==
--------------C2B8F1E264E309E75A904346--