Re: Cyrus IMAP 3.8.3, 3.6.5, and 3.4.8 released

Hello,

Same problem reported here last week. On my production server with  
3.8.1-1~bpo12+1 Debian's bookworm backport package:
https://cyrus.topicbox.com/groups/info/Tfa45b4c4b5affc7d/couldnt-do-list-command-on-mupdate-serverupgrade-murder-cluster-from-3-2-to-3-8

Subject report only the second problem with 3.8.3 on my test cluster.

Not yet tested in production with 3.8.3 and the last patch, but I  
should have the same result.

        Jean Charles Delépine

Quoting Stephan Lauffer <[email protected]>:

> Dear Ellie,
>
> thank's a lot for working on the patch.
>
> We uses builds from  
> https://download.opensuse.org/repositories/home:/buschmann23 and  
> Matthias was so kind to add your patch to a branch for 3.4 and 3.8.
>
> In our murder (atm all productive running on 3.4.7) I have two 3.8  
> backends. They only have a few boxes and there the patch worked fine.
>
> But poorly it failed on a poduktive 3.4 (productive 3.4.7 and tested  
> 3.4.8 with the patch). There we have about 6k users, ctl_mboxlist -v  
> | wc -l says 82684.
>
> 'clt_mailboxlist -m' exits with a " fatal error: mupdate said not us  
> before it said us".
>
> I remember that I read a "said not us before it said us" years/months ago...
>
> So at the moment I can not say that everything is fine now. Hm... :/
>
> Matthias Fehring <[email protected]>
>
>
>
> Zitat von ellie timoney <[email protected]>:
>
>> Hi,
>>
>> We've become aware that the fixes for CVE-2024-34055 break  
>> communications with the mupdate service in Cyrus Murder deployments  
>> (https://github.com/cyrusimap/cyrus-imapd/issues/4932)
>>
>> We're working on a fix, and will publish new releases when it's  
>> ready.  Murder deployments should avoid upgrading to the current  
>> versions, and wait for the next set of releases instead.
>>
>> Sorry for the inconvenience,
>>
>> ellie
>>
>> On Wed, 5 Jun 2024, at 12:41 PM, ellie timoney wrote:
>>> The Cyrus team is proud to announce the immediate availability of  
>>> new versions of Cyrus IMAP: 3.8.3,  3.6.5, and 3.4.8
>>>
>>> These releases contain a fix for CVE-2024-34055  
>>> <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34055>.   
>>> From the release notes:
>>>
>>>> Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow authenticated  
>>>> attackers to cause unbounded memory allocation by sending many  
>>>> LITERALs in a single command.
>>>>
>>>> The IMAP protocol allows for command arguments to be LITERALs of  
>>>> negotiated length, and for these the server allocates memory to  
>>>> receive the content before instructing the client to proceed. The  
>>>> allocated memory is released when the whole command has been  
>>>> received and processed.
>>>>
>>>> The IMAP protocol has a number commands that specify an unlimited  
>>>> number of arguments, for example SEARCH. Each of these arguments  
>>>> can be a LITERAL, for which memory will be allocated and not  
>>>> released until the entire command has been received and  
>>>> processed. This can run a server out of memory, with varying  
>>>> consequences depending on the server's OOM policy.
>>>>
>>>> Discovered by Damian Poddebniak.
>>>
>>> This issue affects all previous Cyrus IMAP releases.
>>>
>>> The updated versions introduce two new imapd.conf limits  
>>> (maxargssize, maxliteral) that operators can configure with safe  
>>> values for their environment.  Please see the release notes and  
>>> other documentation for full details.
>>>
>>> These changes were too intrusive to backport to any earlier  
>>> versions.  If you are running Cyrus IMAP version 3.2 or earlier,  
>>> we suggest upgrading to at least 3.4.8, especially if your service  
>>> has untrusted users.
>>>
>>> Release notes:
>>>
>>>     
>>> https://www.cyrusimap.org/3.8/imap/download/release-notes/3.8/x/3.8.3.html
>>>     
>>> https://www.cyrusimap.org/3.6/imap/download/release-notes/3.6/x/3.6.5.html
>>>     
>>> https://www.cyrusimap.org/3.4/imap/download/release-notes/3.4/x/3.4.8.html
>>>
>>> Download URLs:
>>>
>>>     
>>> https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.8.3/cyrus-imapd-3.8.3.tar.gz
>>>     
>>> https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.8.3/cyrus-imapd-3.8.3.tar.gz.sig
>>>
>>>     
>>> https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.6.5/cyrus-imapd-3.6.5.tar.gz
>>>     
>>> https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.6.5/cyrus-imapd-3.6.5.tar.gz.sig
>>>
>>>     
>>> https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.8/cyrus-imapd-3.4.8.tar.gz
>>>     
>>> https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.8/cyrus-imapd-3.4.8.tar.gz.sig
>>>
>>> On behalf of the Cyrus team,
>>>
>>> ellie timoney
>>> *Cyrus <https://cyrus.topicbox.com/latest>* / Announce / see  
>>> discussions <https://cyrus.topicbox.com/groups/announce> +  
>>> participants <https://cyrus.topicbox.com/groups/announce/members>  
>>> + delivery options  
>>> <https://cyrus.topicbox.com/groups/announce/subscription>  
>>> Permalink  
>>> <https://cyrus.topicbox.com/groups/announce/Ta8e3998446caf7f8-M391040654da3fceae98932e3>
>
>
>
> -- 
> Liebe Gruesse, with best regards
> Stephan Lauffer
>
> Pedagogical University Freiburg - Germany
> http://www.ph-freiburg.de/zik/
> Fon/ Fax: +49 761 682 -559/ -486


-- 
Service systèmes et réseaux - DISI

Université de Picardie Jules Verne
5, rue du moulin neuf - 80000 Amiens


------------------------------------------
Cyrus: Info
Permalink: https://cyrus.topicbox.com/groups/info/Ta8e3998446caf7f8-M791002b2339bcc1afbf700cf
Delivery options: https://cyrus.topicbox.com/groups/info/subscription