http://permalink.gmane.org/gmane.mail.postfix.announce hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://permalink.gmane.org/gmane.mail.postfix.announce/140 <pre>[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.9.3.html] Postfix stable release 2.9.3, and legacy releases 2.8.11, 2.7.10, 2.6.16 are available. They contains workarounds that are already part of Postfix 2.10. * OpenSSL related (all supported Postfix versions). o Some people have reported program crashes when the OpenSSL library was updated while Postfix was accessing the Postfix TLS session cache. To avoid this, the Postfix TLS session cache ID now includes the OpenSSL library version number. This cache ID is not shared via the network. o The OpenSSL workaround introduced with the previous stable and legacy releases did not compile with older gcc compilers. These compilers can't handle #ifdef inside a macro invocation (NOT: definition). * Postfix 2.9 only. o The postconf command flagged parameter "-o name=value" settings in master.cf as "unused" when those</pre> Wietse Venema 2012-05-21T12:55:13 http://permalink.gmane.org/gmane.mail.postfix.announce/139 <pre>[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.9.2.html] Postfix stable release 2.9.2, and legacy releases 2.8.10, 2.7.9, 2.6.15 are available. They contains workarounds that are already part of Postfix 2.10. These releases add support to turn off the TLSv1.1 and TLSv1.2 protocols. Introduced with OpenSSL version 1.0.1, these protocols are known to cause inter-operability problems, for example with some hotmail services. The radical workaround is to temporarily turn off problematic protocols globally: /etc/postfix/main.cf: smtp_tls_protocols = !SSLv2, !TLSv1.1, !TLSv1.2 smtp_tls_mandatory_protocols = !SSLv2, !TLSv1.1, !TLSv1.2 smtpd_tls_protocols = !SSLv2, !TLSv1.1, !TLSv1.2 smtpd_tls_mandatory_protocols = !SSLv2, !TLSv1.1, !TLSv1.2 However, it may be better to temporarily turn off problematic protocols for broken sites only: /etc/postfix/main.cf: smtp_tls_policy_maps = hash:/etc/postfix/tls_p</pre> Wietse Venema 2012-04-24T21:01:29 http://permalink.gmane.org/gmane.mail.postfix.announce/138 <pre>[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.8.9.html] Postfix stable release 2.8.9 is available. This contains fixes that are already part of Postfix 2.9 and 2.10. * The "change header" milter request could replace the wrong header. A long header name could match a shorter one, because a length check was done on the wrong string. Reported by Vladimir Vassiliev. * Core dump when postlog emitted the "usage" message, caused by an extraneous null assignment. Reported by Kant (fnord.hammer). You can find the updated Postfix source code at the mirrors listed at http://www.postfix.org/. Wietse </pre> Wietse Venema 2012-03-05T21:21:02 http://permalink.gmane.org/gmane.mail.postfix.announce/137 <pre>[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.9.1.html] Postfix stable release 2.9.1 is available. This contains fixes that are already part of Postfix 2.10. * The "change header" Milter request could replace the wrong header. A long header name could match a shorter one, because a length check was done on the wrong string. Reported by Vladimir Vassiliev. This was introduced with Postfix 2.3. * "sendmail -bs" segfault, due to a missing guard statement after an smtpd_check_rewrite() call was moved closer to the command processor loop. Fix by Bartek Szady. This was introduced 20111219 near the end of the 2.9 development cycle. You can find the updated Postfix source code at the mirrors listed at http://www.postfix.org/. Wietse </pre> Wietse Venema 2012-02-22T13:34:32 http://permalink.gmane.org/gmane.mail.postfix.announce/136 <pre>[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.7.8.html] Postfix legacy releases 2.7.8, 2.6.14 and 2.5.17 are available. This is the final update for Postfix 2.5, released in 2008. From now on, the supported stable and legacy releases are Postfix 2.6 .. 2.9. New features appear in the Postfix 2.10 development release. * (Postfix 2.5, 2.6) While the Postfix SMTP client's protocol parser uses the last SMTP reply line as intended, the error processing routine was taking information from the beginning of the response. This was causing "Protocol error" bounces with postscreen multi-line responses and Postfix &lt;= 2.6 clients. * (Postfix 2.5, 2.6, 2.7) The fix for local delivery agent database lookup errors was incomplete. The fix correctly added new code to detect database lookup errors with mailbox_transport_maps, mailbox_command_maps or fallback_transport_maps, but it failed to log the problem,</pre> Wietse Venema 2012-02-06T15:45:02 http://permalink.gmane.org/gmane.mail.postfix.announce/135 <pre>Postfix 2.8.8 is reissued. It contained a change that should not have been included and that caused a compilation error. You can undo the unwanted change to the mail_params.h file, or download an updated 2.8.8 release from the mirrors listed at http://www.postfix.org/. Wietse Wietse Venema: [snip] </pre> Wietse Venema 2012-02-01T19:32:12 http://permalink.gmane.org/gmane.mail.postfix.announce/134 <pre>[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.9.0.html] Postfix stable release 2.9.0 is available. The main changes in no particular order are: * Support for long, non-repeating, queue IDs (queue file names). The main benefit of non-repeating names is simpler logfile analysis. See the description of "enable_long_queue_ids" in postconf(5) for details. * Memcache client support, and support to share postscreen(8) and verify(8) caches via the proxymap server. Details are in memcache_table(5) and MEMCACHE_README. * Gradual degradation: if a database is unavailable (can't open, most read or write errors) a Postfix daemon will log a warning and continue providing the services that don't depend on that table, instead of immediately terminating with a fatal error. To terminate immediately when a database file can't be opened, specify "daemon_table_open_error_is_fatal = yes". </pre> Wietse Venema 2012-02-01T13:58:43 http://permalink.gmane.org/gmane.mail.postfix.announce/133 <pre>[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.8.8.html] Postfix legacy release 2.8.8 is available. This contains fixes that are already part of Postfix 2.9 and 2.10. * The Postfix sqlite client, introduced with Postfix 2.8, had an embarassing bug in its quoting routine. As the result of a last-minute code cleanup before release, this routine returned the unquoted text instead of the quoted text. The opportunities for mis-use are limited: Postfix sqlite database files are usually owned by root, and Postfix daemons usually run with non-root privileges so they can't corrupt the database. This problem was reported by Rob McGee (rob0). * The Postfix 2.8.4 fix for local delivery agent database lookup errors was incomplete. The fix correctly added new code to detect database lookup errors with mailbox_transport_maps, mailbox_command_maps or fallback_transport_maps, but it failed </pre> Wietse Venema 2012-02-01T13:57:43 http://permalink.gmane.org/gmane.mail.postfix.announce/132 <pre> [An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.8.7.html] Postfix stable release 2.8.7 is available. This contains a workaround for a problem that is fixed in Postfix 2.9. * The postscreen daemon, which is not enabled by default, sent non-compliant SMTP responses (220- followed by 421) when it could not give a connection to a real smtpd process. These responses caused some remote SMTP clients to return mail as undeliverable. The workaround is to hang up after sending 220- without sending the 421 "sorry" reply; this is harmless. The complete fix involves too much change for a stable release: send the 220 greeting, wait for the EHLO command, then send the 421 "sorry" reply and hang up. You can find the updated Postfix source code at the mirrors listed at http://www.postfix.org/. Wietse </pre> Wietse Venema 2011-11-07T14:55:10 http://permalink.gmane.org/gmane.mail.postfix.announce/131 <pre>[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.8.6.html] Postfix stable release 2.8.6, 2.7.7, 2.6.13 and 2.5.16 are available. These contain fixes that are also included with the Postfix 2.9 experimental release. * The Postfix SMTP daemon sent "bare" newline characters instead of &lt;CR&gt;&lt;LF&gt; when a header_checks REJECT pattern matched multi-line header. This bug was introduced with Postfix 1.1. * The Postfix SMTP daemon sent "bare" newline characters instead of &lt;CR&gt;&lt;LF&gt; when an smtpd_proxy_filter returned a multi-line response. This bug was introduced with Postfix 2.1. * For compatibility with future EAI (email address internationalization) implementations, the Postfix MIME processor no longer enforces the strict_mime_encoding_domain check on unknown message subtypes such as message/global*. This check is disabled by default. * The Postfix master daemon could report a panic error </pre> Wietse Venema 2011-10-24T12:10:05 http://permalink.gmane.org/gmane.mail.postfix.announce/130 <pre>[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.8.5.html] Postfix stable release 2.8.5, 2.7.6, 2.6.12, and 2.5.15 are available. These contain fixes and workarounds for the Postfix Milter client that were already included with the Postfix 2.9 experimental release. * The Postfix Milter client logged a "milter miltername: malformed reply" error when a Milter sent an SMTP response without enhanced status code (i.e. "XXX Text" instead of "XXX X.X.X Text"). * The Postfix Milter client sent a random {client_connections} macro value when the remote SMTP client was not subject to any smtpd_client_* limit. As a workaround, it now sends a zero value instead. You can find the updated Postfix source code at the mirrors listed at http://www.postfix.org/. Wietse </pre> Wietse Venema 2011-09-03T14:30:24 http://permalink.gmane.org/gmane.mail.postfix.announce/129 <pre>[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.7.5.html] Postfix legacy releases 2.7.5, 2.6.11 and 2.5.14 are available. These contain fixes and workarounds that were already included with Postfix stable release 2.8.4. Fixed with Postfix version 2.7.5, 2.6.11 and 2.5.14: * Performance: a high load of DSN success notification requests could slow down the queue manager. Solution: make the trace client asynchronous, just like the bounce and defer clients. * The local(8) delivery agent ignored table lookup errors in mailbox_command_maps, mailbox_transport_maps, fallback_transport_maps and (while bouncing mail to alias) alias owner lookup. * Workaround: dbl.spamhaus.org rejects lookups with "No IP queries" even if the name has an alphanumerical prefix. We play safe, and skip both RHSBL and RHSWL queries for names ending in a numerical suffix. * The Postfix Milter client reported a temp</pre> Wietse Venema 2011-07-11T12:22:04 http://permalink.gmane.org/gmane.mail.postfix.announce/128 <pre> Postfix stable release 2.8.4 [An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.8.4.html] Postfix stable release 2.8.4 is available. This contains fixes and workarounds that were already included with the Postfix 2.9 experimental release. Where applicable these fixes will also be made available for the legacy releases Postfix 2.5..2.7. * Performance: a high load of DSN success notification requests could slow down the queue manager. Solution: make the trace client asynchronous, just like the bounce and defer clients. * The local(8) delivery agent ignored table lookup errors in mailbox_command_maps, mailbox_transport_maps, fallback_transport_maps and (while bouncing mail to alias) alias owner lookup. * Workaround: dbl.spamhaus.org rejects lookups with "No IP queries" even if the name has an alphanumerical prefix. We play safe, and skip both RHSBL and RHSWL queries for names ending in a numeric</pre> Wietse Venema 2011-07-07T19:51:48 http://permalink.gmane.org/gmane.mail.postfix.announce/127 <pre>[On-line version will be at http://www.postfix.org/CVE-2011-1720.html] Summary ======= The Postfix SMTP server has a memory corruption error when the Cyrus SASL library is used with authentication mechanisms other than PLAIN and LOGIN (the ANONYMOUS mechanism is unaffected but should not be enabled for different reasons). See below for instructions to determine what systems are affected. Examples of affected Cyrus SASL authentication methods are CRAM-MD5, DIGEST-MD5, EXTERNAL, GSSAPI, KERBEROS_V4, NTLM, OTP, PASSDSS-3DES-1, and SRP. The error was introduced with the Postfix SASL patch, and is present in all Postfix versions where the command "postconf mail_release_date" reports a value of 20000314 (March 14, 2000) or greater. This problem was discovered by Thomas Jarosch of Intra2net AG. The memory corruption is known to result in a program crash (SIGSEV). Remote code execution cannot be excluded. Such code would execute as the unprivileged "postfix" user. This user has no control over processes that r</pre> Wietse Venema 2011-05-09T12:39:15 http://permalink.gmane.org/gmane.mail.postfix.announce/126 <pre>[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.8.2.html] Postfix stable release 2.8.2 is available. This release has minor fixes that are already in the experimental (2.9) release. - Bugfix: postscreen DNSBL scoring error. When a client disconnected and then reconnected before all DNSBL results for the earlier session arrived, DNSBL results for the earlier session would be added to the score for the later session. This is very unlikely to have affected any legitimate mail. - Workaround: the SMTP client did not support mail to [ipv6:ipv6addr]. - Portability: FreeBSD closefrom() was back-ported to FreeBSD 7, breaking FreeBSD 7.x support retroactively. - Portability: the SUN compiler had trouble with a pointer expression of the form ``("text1" "text2") + constant'' so we don't try to be so clever. You can find Postfix version 2.8.2 at the mirrors listed at http://www.postfix.org/ Wietse </pre> Wietse Venema 2011-03-21T21:07:58 http://permalink.gmane.org/gmane.mail.postfix.announce/125 <pre>[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.7.3.html] Postfix legacy releases 2.7.3, 2.6.9, 2.5.12 and 2.4.16 are available. These releases contain a fix for CVE-2011-0411 which allows plaintext command injection with SMTP sessions over TLS. This defect was introduced with Postfix version 2.2. The same flaw exists in other implementations of the STARTTLS command. Note: CVE-2011-0411 is an issue only for the minority of SMTP clients that actually verify server certificates. Without server certificate verification, clients are always vulnerable to man-in-the-middle attacks that allow attackers to inject plaintext commands or responses into SMTP sessions, and more. Postfix 2.8 and 2.9 are not affected. The following problems were fixed with the Postfix legacy releases: * Fix for CVE-2011-0411: discard buffered plaintext input, after reading the SMTP "STARTTLS" command or response. * Fix to the local delive</pre> Wietse Venema 2011-03-07T20:18:40 http://permalink.gmane.org/gmane.mail.postfix.announce/124 <pre>[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.8.1.html] Postfix stable release 2.8.1 is available. This release fixes one "signal 11" bug with SMTP server debug logging, and cleans up some code and documentation. - Fixed a "signal 11" bug with Postfix SMTP server debug logging at smtpd_tls_loglevel &gt;= 3. - The Postfix SMTP and QMQP servers no longer look up IPv6 address information while looking up the FCRDNS (forward-confirmed reverse DNS) hostname for an IPv4 remote client (and vice versa). - The postscreen(8) daemon no longer logs a "connection reset by peer" warning when a remote SMTP client hangs up prematurely. - Removed spurious configuration parameters from "postconf" output, by deleting the #ifdef MIGRATION_WARNING transitional code from postscreen(8). - Assorted minor documentation fixes. You can find Postfix version 2.8.1 at the mirrors listed at http://www.postfix.org/ Wietse </pre> Wietse Venema 2011-02-23T01:05:06 http://permalink.gmane.org/gmane.mail.postfix.announce/123 <pre>[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.8.0.html] Postfix stable release 2.8.0 is available. This release continues the move towards improving code and documentation, and making the system better prepared for changes in the threat environment. - The postscreen daemon (a zombie blocker in front of Postfix) is now included with the stable release. postscreen now supports TLS and can log the rejected sender, recipient and helo information. See the POSTSCREEN_README file for recommended usage scenarios. - Support for DNS whitelisting (permit_rhswl_client), and for pattern matching to filter the responses from DNS white/blacklist servers (e.g., reject_rhsbl_client zen.spamhaus.org=127.0.0.[1..10]). - Improved message tracking across SMTP-based content filters; the after-filter SMTP server can log the before-filter queue ID (the XCLIENT protocol was extended). - Read-only support for sqlite databases. See sqlite_table(5) and </pre> Wietse Venema 2011-01-21T00:47:18 http://permalink.gmane.org/gmane.mail.postfix.announce/122 <pre>An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-2.7.2.html The stable release Postfix 2.7.2 addresses the defects described below. These defects are also addressed in the legacy releases that are still maintained. Note: Postfix 2.3 and earlier are no longer updated. Support for Postfix 2.4 will end in 2011. Defects fixed with Postfix 2.7.2, 2.6.8, 2.5.11, and 2.4.15: - Postfix no longer automatically appends the system default CA (certificate authority) certificates, when it reads the CA certificates specified with {smtp, lmtp, smtpd}_tls_CAfile or with {smtp, lmtp, smtpd}_tls_CApath. This prevents third-party certificates from getting mail relay permission with the permit_tls_all_clientcerts feature. Unfortunately, this change may cause compatibility problems with configurations that rely on certificate verification for other purposes. To get the old behavior, specify "tls_append_default_CA = yes". - A prior fix for compatibi</pre> Wietse Venema 2010-11-23T22:31:34 http://permalink.gmane.org/gmane.mail.postfix.announce/121 <pre>An on-line version of this announcement is available at http://www.postfix.org/announcements/postfix-2.7.1.html Postfix stable release 2.7.1 fixes one defect in the XFORWARD implementation (for SMTP-based content filters), improves robustness, and has updates for changes in system or library interfaces. * Bugfix (introduced Postfix 2.6) in the XFORWARD implementation, which sends remote SMTP client attributes through SMTP-based content filters. The Postfix SMTP client did not skip "unknown" SMTP client attributes, causing a syntax error when sending an "unknown" client PORT attribute. * Robustness: skip LDAP queries with non-ASCII search strings, instead of failing with a database lookup error. * Safety: Postfix processes now log a warning when a matchlist has a #comment at the end of a line (for example mynetworks or relay_domains). * Portability: OpenSSL 1.0.0 changes the priority of anonymous cyphers. * Portability: Mac OS 10.6.3 re</pre> Wietse Venema 2010-06-08T14:07:15 http://permalink.gmane.org/gmane.mail.postfix.announce/120 <pre>An on-line version of this announcement is available at http://www.postfix.org/announcements/postfix-2.6.7.html Postfix legacy release 2.6.7 contains fixes that are also included with Postfix 2.7 (stable release) and Postfix 2.8 (experimental release). NOTE: Postfix versions 2.3 and earlier are no longer updated. NOTE: Postfix versions 2.4 and 2.5 are updated only for bugfixes or critical problems. * Bugfix (introduced Postfix 2.6) in the XFORWARD implementation, which sends remote SMTP client attributes through SMTP-based content filters. The Postfix SMTP client did not skip "unknown" SMTP client attributes, causing a syntax error when sending an "unknown" client PORT attribute. * Robustness: skip LDAP queries with non-ASCII search strings, instead of failing with a database lookup error. * Portability: OpenSSL 1.0.0 changes the priority of anonymous cyphers. * Portability: Mac OS 10.6.3 requires &lt;arpa/nameser_compat.h&gt; instead of &lt;nameser8_co</pre> Wietse Venema 2010-06-08T14:08:44 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.mail.postfix.announce