Debian Patches
Status for cyrus-imapd/3.10.2-1+deb13u2
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 0001-Disable-runpath-checking.patch | Disable runpath checking | Debian Cyrus Team <pkg-cyrus-imapd-debian-devel@lists.alioth.debian.org> | no | 2024-01-12 | ||
| 0002-Shutdown-and-close-sockets-cleanly.patch | Shutdown and close sockets cleanly Cleanly shutdown and close sockets, this is supposed to allow for better TCP teardown on the remote end, and reduces CLOSE_WAIT time. . This patch was written 8 years ago, it is possible that nowadays nothing will benefit from a shutdown() right before close(). The commit log from eight years ago mentions that SHUT_RD should be upgraded to SHUT_RDWR where possible, but only after verification that this is not going to cause problems (e.g. by discarding data still on flight to the remote). . Also, it is possible that new daemons and utils in Cyrus 2.2 and 2.3 may need similar patches. |
Henrique de Moraes Holschuh <hmh@debian.org> | yes | 2020-02-10 | ||
| 0003-Fix-syslog-prefix.patch | Fix syslog prefix Make sure all programs log (to syslog) with "cyrus/<program>" as the log prefix. |
Sven Mueller <debian@incase.de> | yes | 2020-02-10 | ||
| 0005-Updates-calling-of-the-perl-interpreter-to-what-we-e.patch | Updates calling of the perl interpreter to what we expect in Debian More precisely: Call /usr/bin/perl directly instead of using some shell magic to locate perl and run it. . NOTE: only some script use the "-w" or even the "-T" flag for perl. This should be the default actually. |
Sven Mueller <debian@incase.de> | not-needed | 2020-02-10 | ||
| 0006-Fix-paths-on-Debian-in-tools-rehash.patch | Fix paths on Debian in tools/rehash | Sven Mueller <debian@incase.de> | not-needed | 2020-02-10 | ||
| 0009-Normalize-the-authentication-ID.patch | Normalize the authentication ID By normalize, it is intended that; 1) Authentication IDs all can be lowercased for more accurate comparison without being volatile to, say, user error, and 2) Any leading or trailing blank space can be stripped |
"Jeroen van Meeuwen (Kolab Systems)" <vanmeeuwen@kolabsys.com> | yes | 2022-02-23 | ||
| 0012-Use-UnicodeData.txt-from-system.patch | Use UnicodeData.txt from system | Ondrej Sury <ondrej@debian.org> | not-needed | 2020-02-10 | ||
| 0018-increase-test-timeout.patch | increase test timeout | Xavier Guimard <yadd@debian.org> | not-needed | debian upstream | 2024-01-12 | |
| eventsource-without-websocket.patch | JMAP: allow EventSource (push) without WebSocket/wslay In 3.10.x jmap_push_poll is initialised only inside "if (ws_enabled)", so on builds without libwslay the JMAP EventSource endpoint returns 204 unconditionally while the session still advertises eventSourceUrl (RFC 8620 ยง7.3). Move the initialisation out of the WebSocket guard. . The two cassandane tests from the upstream commit are omitted (not run at Debian package build time). =================================================================== |
Ken Murchison <murch@fastmail.com> | yes | debian upstream | upstream, https://github.com/cyrusimap/cyrus-imapd/commit/d510b3d2bd5954b61770ec5ac51e00b0ed14b6b2 | 2026-07-12 |
| 0020-lmtp_sieve.c-enforce-ACL-on-vacation-fcc-destination.patch | lmtp_sieve.c: enforce ACL on vacation :fcc destination (CVE-2026-47082) An initial debdiff for this CVE batch was submitted by Codin <tellsonmail@yahoo.com> and sponsored/reviewed by Bastian Germann <bage@debian.org> in Debian bug #1142925. This revision adds DEP-3 metadata and, where missing from that debdiff, folds in the matching upstream Cassandane regression test(s). . This is CYR-2892, CVE-2026-47082. . Enforce *some* ACL check when delivering the fcc for a vacation message! Rather than pass aclcheck=0, pass ACL_INSERT: the script owner must be able to write to the target mailbox. . This problem was reported by Michael Lynch (mtlynch.io). . Co-authored-by: Claude <claude@anthropic.com> diff --git a/cassandane/tiny-tests/Sieve/vacation_with_fcc_otheruser_denied b/cassandane/tiny-tests/Sieve/vacation_with_fcc_otheruser_denied new file mode 100644 index 0000000..ed9ff9a |
Ricardo Signes <rjbs@semiotic.systems> | not-needed | debian upstream | upstream, https://github.com/cyrusimap/cyrus-imapd/commit/db6d646d00 | 2026-07-25 |
| 0021-imap-message.c-fix-heap-exposure-in-nested-MIME-comm.patch | imap/message.c: fix heap exposure in nested MIME comment parsing (CVE-2026-47088) An initial debdiff for this CVE batch was submitted by Codin <tellsonmail@yahoo.com> and sponsored/reviewed by Bastian Germann <bage@debian.org> in Debian bug #1142925. This revision adds DEP-3 metadata and, where missing from that debdiff, folds in the matching upstream Cassandane regression test(s). . This is CYR-2882, CVE-2026-47088. . Fix out-of-bounds read in message_parse_rfc822space() when parsing RFC 822 comments that end with backslash. The backslash case would increment p past a NUL terminator, and the subsequent loop increment would read into adjacent heap memory. . Add bounds check after backslash handling to prevent reading past the end of the buffer. . This problem was reported by Michael Lynch (mtlynch.io). . Co-Authored-By: Claude <claude@anthropic.com> diff --git a/cassandane/Cassandane/Cyrus/MIME.pm b/cassandane/Cassandane/Cyrus/MIME.pm new file mode 100644 index 0000000..58df5a2 |
Ricardo Signes <rjbs@semiotic.systems> | not-needed | debian upstream | upstream, https://github.com/cyrusimap/cyrus-imapd/commit/23495997b5 | 2026-07-25 |
| 0022-imapd-MULTISEARCH-must-check-ACL_READ-on-each-mailbo.patch | imapd: MULTISEARCH must check ACL_READ on each mailbox (CVE-2026-47083) An initial debdiff for this CVE batch was submitted by Codin <tellsonmail@yahoo.com> and sponsored/reviewed by Bastian Germann <bage@debian.org> in Debian bug #1142925. This revision adds DEP-3 metadata and, where missing from that debdiff, folds in the matching upstream Cassandane regression test(s). . This is CYR-2881, CVE-2026-47083. . multisearch_cb opened caller-supplied mailboxes from MAILBOXES/SUBTREE/SUBTREE-ONE and ran index_search on them without checking whether the caller could read the mailbox. SELECT has the equivalent gate (imapd.c:5001); MULTISEARCH did not. . The effect is a cross-user read oracle: SUBTREE on another user's account returns one `* ESEARCH ... MAILBOX "..."` line per folder (folder enumeration for free), and BODY/SUBJECT predicates then probe the contents one search at a time. An attacker only needs to be able to name a target mailbox. . This problem was reported by Michael Lynch (mtlynch.io). . Co-Authored-By: Claude <claude@anthropic.com> diff --git a/cassandane/Cassandane/Cyrus/Search.pm b/cassandane/Cassandane/Cyrus/Search.pm index 19e16fa..d9e5e9e 100644 |
Ricardo Signes <rjbs@fastmailteam.com> | not-needed | debian upstream | upstream, https://github.com/cyrusimap/cyrus-imapd/commit/0534c4e30a | 2026-07-25 |
| 0023-imapd-reject-URLFETCH-when-no-mboxkey-exists-for-the.patch | imapd: reject URLFETCH when no mboxkey exists for the mailbox (CVE-2026-47085) An initial debdiff for this CVE batch was submitted by Codin <tellsonmail@yahoo.com> and sponsored/reviewed by Bastian Germann <bage@debian.org> in Debian bug #1142925. This revision adds DEP-3 metadata and, where missing from that debdiff, folds in the matching upstream Cassandane regression test(s). . This is CYR-2876, CVE-2026-47085. . Instead of treating "there's no mboxkey.db entry for this folder" as indicating a zero-length key, treat a missing mboxkey entry as a validation failure. . (Also close the mboxkey db on the previously-unclosed error paths.) . This problem reported by Matthew Horsfall. . Co-Authored-By: Claude <claude@anthropic.com> . Cherry-picked from upstream commits: e5a1055614 cassandane: test for URLFETCH token forgery with empty mboxkey 1d39d32c3b imapd: reject URLFETCH when no mboxkey exists for the mailbox =================================================================== |
Ricardo Signes <rjbs@fastmailteam.com> | not-needed | debian upstream | upstream, https://github.com/cyrusimap/cyrus-imapd/commit/1d39d32c3b | 2026-07-25 |
| 0024-imapd-LISTRIGHTS-requires-admin-rights.patch | imapd: LISTRIGHTS requires admin rights (CVE-2026-47089) An initial debdiff for this CVE batch was submitted by Codin <tellsonmail@yahoo.com> and sponsored/reviewed by Bastian Germann <bage@debian.org> in Debian bug #1142925. This revision adds DEP-3 metadata and, where missing from that debdiff, folds in the matching upstream Cassandane regression test(s). . This is CYR-2872, CVE-2026-47089. . cmd_listrights was refusing only when the caller had *no* rights at all on the target mailbox, when it should've been requiring admin rights. . With this patch, we'll properly require ACL_ADMIN (owners and admins still pass through), matching the check cmd_getacl already uses. When the caller has ACL_LOOKUP but not ACL_ADMIN, return PERMISSION_DENIED; otherwise hide the mailbox as NONEXISTENT. . This problem reported by Matthew Horsfall. . Co-Authored-By: Claude <claude@anthropic.com> . Cherry-picked from upstream commits: 5f406195f7 cassandane: test that LISTRIGHTS requires admin rights 5c97794e52 imapd: LISTRIGHTS requires admin rights diff --git a/cassandane/Cassandane/Cyrus/ACL.pm b/cassandane/Cassandane/Cyrus/ACL.pm index 62fef8e..64ca817 100644 |
Ricardo Signes <rjbs@fastmailteam.com> | not-needed | debian upstream | upstream, https://github.com/cyrusimap/cyrus-imapd/commit/5c97794e52 | 2026-07-25 |
| 0025-imapd-require-read-access-for-XAPPLEPUSHSERVICE-mail.patch | imapd: require read access for XAPPLEPUSHSERVICE mailboxes (CVE-2026-47081) An initial debdiff for this CVE batch was submitted by Codin <tellsonmail@yahoo.com> and sponsored/reviewed by Bastian Germann <bage@debian.org> in Debian bug #1142925. This revision adds DEP-3 metadata and, where missing from that debdiff, folds in the matching upstream Cassandane regression test(s). . This is CYR-2871, CVE-2026-47081. . Only accept a mailbox if the caller is its owner, an admin, or holds ACL_READ. Anything else is silently skipped (no echo, no event), which also preserves the existing "missing" behaviour for non-existent names. . This problem reported by Matthew Horsfall. . Co-Authored-By: Claude <claude@anthropic.com> . Cherry-picked from upstream commits: 1044c0b13b cassandane: test XAPPLEPUSHSERVICE leaks other users' folders 50f77bad30 imapd: require read access for XAPPLEPUSHSERVICE mailboxes diff --git a/cassandane/Cassandane/Cyrus/XApplePushService.pm b/cassandane/Cassandane/Cyrus/XApplePushService.pm new file mode 100644 index 0000000..497d505 |
Ricardo Signes <rjbs@fastmailteam.com> | not-needed | debian upstream | upstream, https://github.com/cyrusimap/cyrus-imapd/commit/50f77bad30 | 2026-07-25 |
| 0026-imapd.c-re-check-URLAUTH-authorizer-access-just-in-t.patch | imapd.c: re-check URLAUTH authorizer access just in time (CVE-2026-47087) An initial debdiff for this CVE batch was submitted by Codin <tellsonmail@yahoo.com> and sponsored/reviewed by Bastian Germann <bage@debian.org> in Debian bug #1142925. This revision adds DEP-3 metadata and, where missing from that debdiff, folds in the matching upstream Cassandane regression test(s). . This is CYR-2868, CVE-2026-47087. . cmd_urlfetch validated the HMAC token against the authorizer's mboxkey, but skipped any ACL check whenever url.urlauth.access was set. Sure, the rights existed right at that moment, but if access is revoked after the URL is created, the URL needs to stop working. We need to just check access JIT. . Co-Authored-By: Claude <claude@anthropic.com> . Cherry-picked from upstream commits: be5eabb4df cassandane: tighten URLAuth ACL bypass test fbb130b339 cassandane: fix indenting in cassandane/tiny-tests/URLAuth/perms bdf709102c cassandane: URLAUTH must re-check authorizer ACLs at fetch time 8380d0fb3d imapd.c: re-check URLAUTH authorizer access just in time =================================================================== |
Ricardo Signes <rjbs@fastmailteam.com> | not-needed | debian upstream | upstream, https://github.com/cyrusimap/cyrus-imapd/commit/8380d0fb3d | 2026-07-25 |
| 0027-imapd-require-read-access-on-mailbox-in-GENURLAUTH.patch | imapd: require read access on mailbox in GENURLAUTH (CVE-2026-47086) An initial debdiff for this CVE batch was submitted by Codin <tellsonmail@yahoo.com> and sponsored/reviewed by Bastian Germann <bage@debian.org> in Debian bug #1142925. This revision adds DEP-3 metadata and, where missing from that debdiff, folds in the matching upstream Cassandane regression test(s). . This is CYR-2868, CVE-2026-47086. . You can't grant access to things you can't access! Without this check, any authenticated user could mint a URLAUTH token for any mailbox they could name, because cmd_urlfetch skipped the ACL check whenever urlauth.access is set -- it trusts that the presence of a valid HMAC means the authorizing user was entitled to delegate. . Require the authorizer to have at least ACL_READ on the mailbox before issuing a token. . This problem reported by Matthew Horsfall. . Co-Authored-By: Claude <claude@anthropic.com> . Cherry-picked from upstream commits: 88d9bf6e7e cassandane: test for ACL bypass in URLAuth e7a28ccf9b imapd: require read access on mailbox in GENURLAUTH =================================================================== |
Ricardo Signes <rjbs@fastmailteam.com> | not-needed | debian upstream | upstream, https://github.com/cyrusimap/cyrus-imapd/commit/e7a28ccf9b | 2026-07-25 |
| 0028-imapd-fix-cmd_delete-force-handling.patch | imapd: fix cmd_delete 'force' handling (LOCALDELETE ACL bypass) (CVE-2026-47084) An initial debdiff for this CVE batch was submitted by Codin <tellsonmail@yahoo.com> and sponsored/reviewed by Bastian Germann <bage@debian.org> in Debian bug #1142925. This revision adds DEP-3 metadata and, where missing from that debdiff, folds in the matching upstream Cassandane regression test(s). . This is CYR-2867, CVE-2026-47084. . Non-admin users could invoke the admin-only LOCALDELETE command and delete mailboxes without permission, because MBOXLIST_DELETE_FORCE wasn't being plumbed through to mboxlist_deletemailbox. . Reported by Michael Lynch (mtlynch.io). . Cherry-picked from upstream commits: 2c871deac5 Delete: test localdelete of other user's mailbox 304255f5be imapd: fix cmd_delete 'force' handling 7dfc43c681 MurderIMAP: localdelete requires admin privs diff --git a/cassandane/Cassandane/Cyrus/Delete.pm b/cassandane/Cassandane/Cyrus/Delete.pm index 10f9fb6..fc778af 100644 |
ellie timoney <ellie@fastmail.com> | not-needed | debian upstream | upstream, https://github.com/cyrusimap/cyrus-imapd/commit/304255f5be | 2026-07-25 |
All known versions for source package 'cyrus-imapd'
- 3.12.4-1 (sid)
- 3.12.3-4 (forky)
- 3.12.3-1~bpo13+1 (trixie-backports)
- 3.10.2-1+deb13u2 (trixie-proposed-updates)
- 3.10.2-1 (trixie)
- 3.10.2-1~bpo12+1 (bookworm-backports)
- 3.6.1-4+deb12u5 (bookworm-security)
- 3.6.1-4+deb12u4 (bookworm)