-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 17 Jun 2023 13:34:11 -0400 Source: postfix Architecture: source Version: 3.7.6-0+deb12u1 Distribution: bookworm Urgency: medium Maintainer: LaMont Jones <lamont@debian.org> Changed-By: Scott Kitterman <scott@kitterman.com> Changes: postfix (3.7.6-0+deb12u1) bookworm; urgency=medium . [Scott Kitterman] . * Refresh patches . [Wietse Venema] . * 3.7.6 - Bugfix (defect introduced: Postfix 1.0): the command "postconf .. name=v1 .. name=v2 .." (multiple instances of the same parameter name) created multiple name=value entries with the same parameter name. It now logs a warning and skips the earlier update. Found during code maintenance. File: postconf/postconf_edit.c . - Bugfix (defect introduced: Postfix 3.3): the command "postconf -M name1/type1='name2 type2 ...'" died with a segmentation violation when the request matched multiple master.cf entries. The master.cf file was not damaged. Problem reported by SATOH Fumiyasu. File: postconf/postconf_master.c. . - Bugfix (defect introduced: Postfix 2.11): the command "postconf -M name1/type1='name2 type2 ...'" could add a service definition to master.cf that conflicted with an already existing service definition. It now replaces all existing service definitions that match the service pattern 'name1/type1' or the service name and type in 'name2 type2 ...' with a single service definition 'name2 type2 ...'. Problem reported by SATOH Fumiyasu. File: postconf/postconf_edit.c. . - Bitrot: preliminary support for OpenSSL configuration files, primarily OpenSSL 1.1.1b and later. This introduces new parameters "tls_config_file" and "tls_config_name", which can be used to limit collateral damage from OS distributions that crank up security to 11, increasing the number of plaintext email deliveries. Details are in the postconf(5) manpage under "tls_config_file" and "tls_config_name". Viktor Dukhovni. Files: mantools/postlink, proto/postconf.proto, global/mail_params.h, posttls-finger/posttls-finger.c, smtp/smtp.c, smtp/smtp_proto.c, tls/tls_client.c, tls/tls.h, tls/tls_misc.c, tls/tls_proxy_client_print.c, tls/tls_proxy_client_scan.c, tls/tls_proxy.h, tls/tls_server.c, tlsproxy/tlsproxy.c. . - Cleanup: use TLS_CLIENT_PARAMS to pass the OpensSSL 'init' configurations. This information is independent from the client or server TLS context, and therefore does not belong in tls_*_init() or tls_*_start() calls. The tlsproxy(8) server uses TLS_CLIENT_PARAMS to report differences between its own global TLS settings, and those from its clients. Files: posttls-finger/posttls-finger.c, smtp/smtp.c, smtp/smtp_proto.c, tls/tls.h, tls/tls_proxy_client_misc.c, tls/tls_proxy_client_print.c, tls/tls_proxy_client_scan.c, tls/tls_proxy.h, tlsproxy/tlsproxy.c. . - Cleanup: reverted cosmetic-only changes to minimize the patch footprint for OpenSSL INI file support; updated daemon manpages with the new tls_config_file and tls_config_name configuration parameters. Files: smtp/smtp.c, smtpd/smtpd.c, tls/tls_client.c, tls/tls.h, tls/tls_server.c, tlsproxy/tlsproxy.c, . - Cleanup: made OpenSSL 'default' INI file support error handling consistent with OpenSSL default behavior. Viktor Dukhovni. Files: proto/postconf.proto, tls/tls_misc.c. . - Backwards compatibility for stable releases that originally had no OpenSSL INI support. Skip the new OpenSSL INI support code, unless the Postfix configuration actually specifies non-default tls_config_xxx settings. File: tls/tls_misc.c. . - Cleanup: added a multiple initialization guard in the tls_library_init() function, and made an initialization error sticky. File: tls/tls_misc.c. . - Security: new parameter smtpd_forbid_unauth_pipelining (default: no) to disconnect remote SMTP clients that violate RFC 2920 (or 5321) command pipelining constraints. Files: global/mail_params.h, smtpd/smtpd.c, proto/postconf.proto. Checksums-Sha1: d3c7c8d66f78f9f38d379477a84f1a703237bc49 3008 postfix_3.7.6-0+deb12u1.dsc 255a4986838a1733b3ff09a299245374358c4dc7 4831551 postfix_3.7.6.orig.tar.gz daa0d95571dfd640ba4b734025cc7fa7490d49a4 220 postfix_3.7.6.orig.tar.gz.asc eaf2562cdc409872a981f7df372df7a319130bce 195524 postfix_3.7.6-0+deb12u1.debian.tar.xz 495318df0416d2ce70f17619afa9758b6ddc5167 7671 postfix_3.7.6-0+deb12u1_source.buildinfo Checksums-Sha256: 4c8adc5e309ed6a5980ae03e5f299f3cf384ec02bc0f4b08c03a3cd7d63bfcf6 3008 postfix_3.7.6-0+deb12u1.dsc c9719303bce5b74b9d42a00d9e2ce5dace9fd9e900d338ebd8adec4e4966cb40 4831551 postfix_3.7.6.orig.tar.gz 7faa59499c992676ad23ef50bbd00a19ffddbaf97438171a4e2f5e2d408a902a 220 postfix_3.7.6.orig.tar.gz.asc d723c7356ed3d48d38a39587575e5482dfbdba9a8129dbd235029f5b5ec52b62 195524 postfix_3.7.6-0+deb12u1.debian.tar.xz ee7f79ac8f729aab65625e553b36409ec3f02614578b4432a1392f59f5522894 7671 postfix_3.7.6-0+deb12u1_source.buildinfo Files: 7b51153d16ed5c9ce87b17bd3238a017 3008 mail optional postfix_3.7.6-0+deb12u1.dsc 6011aeb0016831a466e8b440914a3ff4 4831551 mail optional postfix_3.7.6.orig.tar.gz e7b4810a35d9acf752c920a227d072f3 220 mail optional postfix_3.7.6.orig.tar.gz.asc 50ec50c996f89aeef6ca0bfa67461a99 195524 mail optional postfix_3.7.6-0+deb12u1.debian.tar.xz 0f6016b0c7080af60223fe0d742fce52 7671 mail optional postfix_3.7.6-0+deb12u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE53Kb/76FQA/u7iOxeNfe+5rVmvEFAmSN7sUACgkQeNfe+5rV mvFlyA/+Md21E5aOfccojt1YluCYoYVvhslzGKGrIf8OYLpqGPUoPHD45ZVrritn JMJB3ExF/Uazzz4pLZ0diiELEE9Cvp2pJlU4Elto15GHH+zQKOyWax7/YIlZPRxT faXTMPse0QJxmpCAECSlMZxy/aeBuZvfFdK+09vdEARF0baxqmODRiyrIWeHdIO3 uj8mQTUGIlllKbJt0ZhYbOgT01w6nu7vN59HoympML3ma/LAn+3/Mle/ZTJ0Gnne IMM7wVe5WkwlmkRqhJo1o2450CVZaUSaB1gYQ6KoFChrgMWqtPskmuhqgyyjHuyh urOhCBy9B1zMGLMJJ/ieKpetNmTAOFZEzcn/kHEcWr02BgpYqN8X7mYvMyvGRHsn clwAPIAdLb5SMY1vPXPCS3Hn9n8MOlEHQmpdCvCq6cqk5nzpESurjQLCsInuxRMv 9286lQmoWjHBWfwqLrOSPkBtGOfBykx/67fYsUXrAucOnxTfAsjIiaCdD021FXM8 pGHWkndF9eia8GB56lwLZpNc+1XIpUl49Oz2eGWzUvtExvJibwbC8HHZCIdYhysu NrB+hjHBC+ybArxme+JChBcAqRFBhaWHlmcLdEJ8LxJFcZo0t+NowgOGJ1TzlKXX x2bhsnY7I/OT2TRCev6VsHOGhvS/itPH28qyDjGskV54J4FLX48= =Yg/W -----END PGP SIGNATURE-----