Re: CVE-2016-8652 in dovecot

2016-12-02 Thread Noel Butler
On 03/12/2016 12:08, Jeremiah C. Foster wrote: > On Fri, 2016-12-02 at 10:48 +0200, Aki Tuomi wrote: > On 02.12.2016 10:45, Jonas Wielicki wrote: On Freitag, 2. Dezember 2016 > 09:00:58 CET Aki Tuomi wrote: We are sorry to report that we have a bug in > dovecot, which > merits a > CVE. See deta

Re: CVE-2016-8652 in dovecot

2016-12-02 Thread Jeremiah C. Foster
On Fri, 2016-12-02 at 10:48 +0200, Aki Tuomi wrote: > > On 02.12.2016 10:45, Jonas Wielicki wrote: > > On Freitag, 2. Dezember 2016 09:00:58 CET Aki Tuomi wrote: > > > We are sorry to report that we have a bug in dovecot, which > > > merits a > > > CVE. See details below. If you haven't configured

Virtual mailboxes, please help

2016-12-02 Thread Peter Hodur
Hi, I'm trying to setup virtual mailboxes. My setup: - migrated from Courier, so: separator = . prefix = INBOX. inbox = yes In doc i have read, thant i need to create separate namespace. namespace { prefix = virtual/ separator = / location = virtual:~/Maildir/virtual So i need to change /

LMTP delivery honours .forward by default?

2016-12-02 Thread MRob
I was under the impression that Dovecot does not look at .forward by default, since of course, Sieve is where that kind of logic should go. However, I'm seeing a .forward file being honoured by the LMTP delivery agent. Is this to be expected?

Re: CVE-2016-8562 in dovecot

2016-12-02 Thread Aki Tuomi
> On December 2, 2016 at 7:50 PM "A. Schulze" wrote: > > > > > Am 02.12.2016 um 08:00 schrieb Aki Tuomi: > > Workaround is to disable auth-policy component until fix is in place. > > This can be done by commenting out all auth_policy_* settings. > > Hello, > > could you be more verbose on h

Re: Too many references: cannot splice

2016-12-02 Thread Sebastian Köhler
December 2, 2016 6:58 PM, "Luis Ugalde" wrote: > On October 13th I sent a new email with subject "Too many references: > cannot splice" with a reference to a lklm post. Thanks Luis for the info. I wonder why I did not find that post... > You will find more info. and a patch there. I can confirm

Re: Too many references: cannot splice

2016-12-02 Thread Luis Ugalde
Sebastian, On October 13th I sent a new email with subject "Too many references: cannot splice" with a reference to a lklm post. You will find more info. and a patch there. I can confirm the patch is working for us. Regards, Luis Ugalde On Fri, Dec 2, 2016 at 5:23 PM, Sebastian Köhler wrote:

Re: CVE-2016-8562 in dovecot

2016-12-02 Thread A. Schulze
Am 02.12.2016 um 08:00 schrieb Aki Tuomi: > Workaround is to disable auth-policy component until fix is in place. > This can be done by commenting out all auth_policy_* settings. Hello, could you be more verbose on how to verify if administrators are affected? # doveconf -n | grep auth_policy_

Too many references: cannot splice

2016-12-02 Thread Sebastian Köhler
Hello, multiple times per day one of our Dovecot servers has the problem that it suddenly refuses to accept new connections and then floods the logs with these messages: Dec 2 12:43:06 alfa3201 dovecot: pop3-login: Error: fd_send(pop3, 18) failed: Too many references: cannot splice Dec 2 12:

Re: Defining INDEX target to other location than maildir seems to have no effect.

2016-12-02 Thread Aki Tuomi
Hi! Sorry it took a while. I tested with 2.2.26.0, and it seems to work ok, can you try with later release? I tried both INDEX=MEMORY and INDEX=~/indexes Aki On 05.11.2016 23:40, Aki Tuomi wrote: > Hi! > > Thank you for reporting this, we'll look into it. > > Aki Tuomi > Dovecot oy. > > >> On

Re: CVE-2016-8652 in dovecot

2016-12-02 Thread Aki Tuomi
On 02.12.2016 10:45, Jonas Wielicki wrote: > On Freitag, 2. Dezember 2016 09:00:58 CET Aki Tuomi wrote: >> We are sorry to report that we have a bug in dovecot, which merits a >> CVE. See details below. If you haven't configured any auth_policy_* >> settings you are ok. This is fixed with >> http

Re: CVE-2016-8562 in dovecot

2016-12-02 Thread Jonas Wielicki
On Freitag, 2. Dezember 2016 09:00:58 CET Aki Tuomi wrote: > We are sorry to report that we have a bug in dovecot, which merits a > CVE. See details below. If you haven't configured any auth_policy_* > settings you are ok. This is fixed with > https://git.dovecot.net/dovecot/core/commit/c3d3faa4f72