diff -pruN 1:2.3.19.1+dfsg1-2.1/debian/changelog 1:2.3.19.1+dfsg1-2.1ubuntu1/debian/changelog --- 1:2.3.19.1+dfsg1-2.1/debian/changelog 2023-01-20 06:01:26.000000000 +0000 +++ 1:2.3.19.1+dfsg1-2.1ubuntu1/debian/changelog 2023-05-19 01:47:09.000000000 +0000 @@ -1,3 +1,18 @@ +dovecot (1:2.3.19.1+dfsg1-2.1ubuntu1) mantic; urgency=medium + + * Merge with Debian unstable (LP: #2018068). Remaining changes: + - d/control: Build against Lua 5.3 rather than 5.4. + (LP #1909665) + * Dropped: + - d/rules: Package references hidden symbols during an LTO link. + This needs further investigation. Until then, disable LTO. + Disable Debian's recent enablement of LTO as well, + as it FTBFS when building with gcc 11. + (LP #1951325) + [Fixed in upstream commit f0c1cf42] + + -- Bryce Harrington Fri, 19 May 2023 01:47:09 +0000 + dovecot (1:2.3.19.1+dfsg1-2.1) unstable; urgency=medium * Non-maintainer upload. @@ -6,6 +21,46 @@ dovecot (1:2.3.19.1+dfsg1-2.1) unstable; -- Bas Couwenberg Fri, 20 Jan 2023 07:01:26 +0100 +dovecot (1:2.3.19.1+dfsg1-2ubuntu4) lunar; urgency=medium + + * Rebuild against latest icu + + -- Jeremy Bicha Mon, 06 Feb 2023 07:33:52 -0500 + +dovecot (1:2.3.19.1+dfsg1-2ubuntu3) lunar; urgency=medium + + * No-change rebuild against libldap-2 + + -- Steve Langasek Thu, 15 Dec 2022 19:46:57 +0000 + +dovecot (1:2.3.19.1+dfsg1-2ubuntu2) kinetic; urgency=medium + + * d/control: Build against Lua 5.3 rather than 5.4 for kinetic + + -- Bryce Harrington Fri, 12 Aug 2022 01:08:37 +0000 + +dovecot (1:2.3.19.1+dfsg1-2ubuntu1) kinetic; urgency=medium + + * Merge with Debian unstable (LP: #1971273). Remaining changes: + - d/rules: Package references hidden symbols during an LTO link. + This needs further investigation. Until then, disable LTO. + Disable Debian's recent enablement of LTO as well, + as it FTBFS when building with gcc 11. + (LP #1951325) + * Dropped: + - d/p/OpenSSL3.patch: Workaround to fix EC key handling when building + with OpenSSL 3.0. + (LP: #1945763) + [Fixed in Debian release 1:2.3.19+dfsg1-1] + - privilege escalation via multiple passdbs + + d/p/CVE-2022-30550.patch: fix handling passdbs with + identical driver/args but different mechanisms/username_filter in + src/auth/auth-request.c, src/auth/auth.c, src/auth/auth.h, + src/auth/passdb.c, src/auth/passdb.h. + [Fixed in Debian release 1:2.3.19.1+dfsg1-2] + + -- Bryce Harrington Tue, 09 Aug 2022 23:02:29 -0700 + dovecot (1:2.3.19.1+dfsg1-2) unstable; urgency=medium [ Christian Göttsche ] @@ -75,6 +130,58 @@ dovecot (1:2.3.17.1+dfsg1-1) unstable; u -- Noah Meyerhans Tue, 14 Dec 2021 09:24:23 -0800 +dovecot (1:2.3.16+dfsg1-3ubuntu4) kinetic; urgency=medium + + * SECURITY UPDATE: privilege escalation via multiple passdbs + - debian/patches/CVE-2022-30550.patch: fix handling passdbs with + identical driver/args but different mechanisms/username_filter in + src/auth/auth-request.c, src/auth/auth.c, src/auth/auth.h, + src/auth/passdb.c, src/auth/passdb.h. + - CVE-2022-30550 + + -- Marc Deslauriers Mon, 11 Jul 2022 10:21:41 -0400 + +dovecot (1:2.3.16+dfsg1-3ubuntu3) kinetic; urgency=medium + + * No-change rebuild against libicu71 + + -- Steve Langasek Sat, 30 Apr 2022 01:54:59 +0000 + +dovecot (1:2.3.16+dfsg1-3ubuntu2) jammy; urgency=medium + + * No-change rebuild for icu soname change. + + -- Matthias Klose Wed, 09 Feb 2022 09:13:08 +0100 + +dovecot (1:2.3.16+dfsg1-3ubuntu1) jammy; urgency=medium + + [ Bryce Harrington ] + * Merge with Debian unstable. (LP: #1946855) + Remaining changes: + - Package references hidden symbols during an LTO link. This needs further + investigation. Until then, disable LTO. + * Dropped: + - SECURITY UPDATE: incorrectly escapes kid and azp fields in JWT tokens + + debian/patches/CVE-2021-29157.patch: improve escaping in + src/lib-dict-extra/dict-fs.c, src/lib-oauth2/oauth2-jwt.c, + src/lib-oauth2/test-oauth2-jwt.c. + [Included in Debian 1:2.3.13+dfsg1-2] + - SECURITY UPDATE: plaintext command injection before STARTTLS + + debian/patches/CVE-2021-33515.patch: properly handle command queue in + src/lib-smtp/smtp-server-cmd-starttls.c, + src/lib-smtp/smtp-server-connection.c. + [Included in Debian 1:2.3.13+dfsg1-2] + * d/rules: Disable Debian's recent enablement of LTO as well, as it + FTBFS when building with gcc 11. + (LP: #1951325) + + [ Simon Chopin ] + * d/p/OpenSSL3.patch: Workaround to fix EC key handling when building + with OpenSSL 3.0. + (LP: #1945763) + + -- Bryce Harrington Wed, 17 Nov 2021 13:46:08 -0800 + dovecot (1:2.3.16+dfsg1-3) unstable; urgency=medium * [7b858b6] Fix FTBFS on mips(64)el. Stacktrace generation on these @@ -126,6 +233,40 @@ dovecot (1:2.3.13+dfsg1-2) unstable; urg -- Noah Meyerhans Tue, 20 Jul 2021 08:05:19 -0700 +dovecot (1:2.3.13+dfsg1-1ubuntu3) impish; urgency=medium + + * No-change rebuild due to OpenLDAP soname bump. + + -- Sergio Durigan Junior Mon, 21 Jun 2021 17:46:46 -0400 + +dovecot (1:2.3.13+dfsg1-1ubuntu2) impish; urgency=medium + + * SECURITY UPDATE: incorrectly escapes kid and azp fields in JWT tokens + - debian/patches/CVE-2021-29157.patch: improve escaping in + src/lib-dict-extra/dict-fs.c, src/lib-oauth2/oauth2-jwt.c, + src/lib-oauth2/test-oauth2-jwt.c. + - CVE-2021-29157 + * SECURITY UPDATE: plaintext command injection before STARTTLS + - debian/patches/CVE-2021-33515.patch: properly handle command queue in + src/lib-smtp/smtp-server-cmd-starttls.c, + src/lib-smtp/smtp-server-connection.c. + - CVE-2021-33515 + + -- Marc Deslauriers Wed, 16 Jun 2021 09:02:15 -0400 + +dovecot (1:2.3.13+dfsg1-1ubuntu1) hirsute; urgency=medium + + * Package references hidden symbols during an LTO link. This needs further + investigation. Until then, disable LTO. + + -- Matthias Klose Tue, 30 Mar 2021 17:23:55 +0200 + +dovecot (1:2.3.13+dfsg1-1build1) hirsute; urgency=high + + * No change rebuild against clucene-core + + -- Balint Reczey Thu, 18 Feb 2021 18:19:47 +0100 + dovecot (1:2.3.13+dfsg1-1) unstable; urgency=medium [ Christian Göttsche ] diff -pruN 1:2.3.19.1+dfsg1-2.1/debian/control 1:2.3.19.1+dfsg1-2.1ubuntu1/debian/control --- 1:2.3.19.1+dfsg1-2.1/debian/control 2023-01-20 06:01:26.000000000 +0000 +++ 1:2.3.19.1+dfsg1-2.1ubuntu1/debian/control 2023-05-19 01:47:09.000000000 +0000 @@ -1,7 +1,8 @@ Source: dovecot Section: mail Priority: optional -Maintainer: Dovecot Maintainers +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Dovecot Maintainers Uploaders: Jaldhar H. Vyas , Jelmer Vernooij , Apollon Oikonomopoulos , @@ -18,7 +19,7 @@ Build-Depends: debhelper-compat (= 13), libexttextcat-dev, libicu-dev, libldap2-dev, - liblua5.4-dev, + liblua5.3-dev, liblz4-dev, liblzma-dev, libpam0g-dev,