RHBA-2015:1348 - Bug Fix Advisory

Topic

Updated dovecot packages that fix several bugs and add one enhancement are now
available for Red Hat Enterprise Linux 6.

Description

Dovecot is an IMAP server for Linux and other UNIX-like systems, primarily
written with security in mind. It also contains a small POP3 server, and
supports e-mail in either the maildir or mbox format. The SQL drivers and
authentication plug-ins are provided as subpackages.

This update fixes the following bugs:

• The ports used by dovecot were in some cases unavailable during the boot

process by other services, which caused dovecot to fail to start and display an
"Address already in use" error. This update configures the portreserve service
to ensure that dovecot's ports stay available during the boot process, which
prevents the described failure from occurring. (BZ#723228)

• Previously, the dovecot utility used too small a login input buffer for

Kerberos authentication. As a consequence, users who attempted to use Kerberos
authentication were not able to log in. This updated version of dovecot uses a
bigger input buffer, and users can now authenticate to their email accounts
using a Kerberos ticket. (BZ#771336)

• Prior to this update, dovecot logged a redundant "unable to get certificate"

error message when no certification revocation list (CRL) was available. With
this update, dovecot no longer treats missing CRL as an error, and no longer
logs an error in the mentioned scenario. (BZ#813957)

• When the LIST-STATUS extension was used with certain hierarchy separator

symbols, dovecot in some cases terminated unexpectedly. Consequently, the user
was unable to list the contents of their e-mail folder. This update fixes the
code for traversing folders, and using LIST-STATUS no longer causes dovecot to
crash. (BZ#961466)

• Previously, after executing the "uid copy" command against a non-existent

mailbox, the dovecot server became unresponsive. As a consequence, the user
could not download e-mails unless recovered manually. A patch has been provided
to fix this bug, and dovecot no longer hangs in the aforementioned scenario.
(BZ#1131749)

In addition, this update adds the following enhancement:

• With this update, it is possible to configure which Secure Sockets Layer (SSL)

protocols dovecot allows. Among other things, this allows users to disable SSLv3
connections and thus mitigate the impact of the POODLE vulnerability. Due to
security concerns, SSLv2 and SSLv3 are now also disabled by default, and the
user has to be allow them manually if required. (BZ#1153041)

Users of dovecot are advised to upgrade to these updated packages, which fix
these bugs and add this enhancement.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 730746 - dovecot does not assign stderr to /dev/null
• BZ - 813957 - dovecot proxy SSL connection requires CRLs
• BZ - 961466 - dovecot imap crashes when using LIST command with LIST-STATUS extension
• BZ - 1100756 - Installation of dovecot in FIPS mode hangs yum
• BZ - 1124783 - can we have dovecot use tcp_wrappers please
• BZ - 1140459 - dovecot was failed starting with the error "Fatal: Failed to start listeners".
• BZ - 1153041 - RFE: backport method to disable SSLv3 or disable SSv3 permanently
• BZ - 1182619 - ALL in ssl_protocols does not match TLSv1.{1,2}
• BZ - 1184865 - Dovecot reports "Error: BUG: Saving failed to unknown storage"

CVEs

(none)

References

(none)