From: Aki Tuomi Date: Tue, 21 Apr 2020 07:18:44 +0000 (+0300) Subject: NEWS: Add news for 2.3.10.1 X-Git-Tag: 2.3.10.1~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=77231b02937eb973ddc9acb5a66859bae5595cb1;p=thirdparty%2Fdovecot%2Fcore.git NEWS: Add news for 2.3.10.1 --- diff --git a/NEWS b/NEWS index 51be004cfb..077c1d1f2f 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,21 @@ +v2.3.10.1 2020-05-18 Aki Tuomi + + - CVE-2020-10957: lmtp/submission: A client can crash the server by + sending a NOOP command with an invalid string parameter. This occurs + particularly for a parameter that doesn't start with a double quote. + This applies to all SMTP services, including submission-login, which + makes it possible to crash the submission service without + authentication. + - CVE-2020-10958: lmtp/submission: Sending many invalid or unknown + commands can cause the server to access freed memory, which can lead + to a server crash. This happens when the server closes the connection + with a "421 Too many invalid commands" error. The bad command limit + depends on the service (lmtp or submission) and varies between 10 to + 20 bad commands. + - CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an + address that has the empty quoted string as local-part causes the lmtp + service to crash. + v2.3.10 2020-03-06 Aki Tuomi * Disable retpoline migitations by default. These can cause severe