Debian Patches

Status for cyrus-imapd/3.6.1-4+deb12u5

Patch Description Author Forwarded Bugs Origin Last update
0001-Disable-runpath-checking.patch Disable runpath checking
@DPATCH@		 Debian Cyrus Team <pkg-cyrus-imapd-debian-devel@lists.alioth.debian.org> no 2020-02-10
0002-Shutdown-and-close-sockets-cleanly.patch Shutdown and close sockets cleanly Cleanly shutdown and close sockets, this is supposed to allow for better
TCP teardown on the remote end, and reduces CLOSE_WAIT time.
.
This patch was written 8 years ago, it is possible that nowadays nothing
will benefit from a shutdown() right before close(). The commit log
from eight years ago mentions that SHUT_RD should be upgraded to
SHUT_RDWR where possible, but only after verification that this is not
going to cause problems (e.g. by discarding data still on flight to the
remote).
.
Also, it is possible that new daemons and utils in Cyrus 2.2 and 2.3 may
need similar patches.		 Henrique de Moraes Holschuh <hmh@debian.org> yes 2020-02-10
0003-Fix-syslog-prefix.patch Fix syslog prefix Make sure all programs log (to syslog) with "cyrus/<program>" as the
log prefix.		 Sven Mueller <debian@incase.de> yes 2020-02-10
0005-Updates-calling-of-the-perl-interpreter-to-what-we-e.patch Updates calling of the perl interpreter to what we expect in Debian More precisely: Call /usr/bin/perl directly instead of using some
shell magic to locate perl and run it.
.
NOTE: only some script use the "-w" or even the "-T" flag for perl.
This should be the default actually.		 Sven Mueller <debian@incase.de> not-needed 2020-02-10
0006-Fix-paths-on-Debian-in-tools-rehash.patch Fix paths on Debian in tools/rehash Sven Mueller <debian@incase.de> not-needed 2020-02-10
0009-Normalize-the-authentication-ID.patch Normalize the authentication ID By normalize, it is intended that;
1) Authentication IDs all can be lowercased for more accurate
comparison without being volatile to, say, user error, and
2) Any leading or trailing blank space can be stripped		 "Jeroen van Meeuwen (Kolab Systems)" <vanmeeuwen@kolabsys.com> yes 2022-02-23
0012-Use-UnicodeData.txt-from-system.patch Use UnicodeData.txt from system Ondrej Sury <ondrej@debian.org> not-needed 2020-02-10
0018-increase-test-timeout.patch increase test timeout Xavier Guimard <yadd@debian.org> not-needed debian upstream 2020-05-20
0020_fix-cyr_cd-shebang.patch fix shebang cyr_cd.sh isn't a valid sh script but a bash one Yadd <yadd@debian.org> yes 2022-10-12
fix-upgrade-versions.patch fix the minimal version needed to update Yadd <yadd@debian.org> not-needed debian 2023-07-19
CVE-2024-34055.patch Cumulative patch for CVE-2024-34055 Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow authenticated attackers to
cause unbounded memory allocation by sending many LITERALs in a single command.
.
The IMAP protocol allows for command arguments to be LITERALs of negotiated
length, and for these the server allocates memory to receive the content before
instructing the client to proceed. The allocated memory is released when the
whole command has been received and processed.
.
The IMAP protocol has a number commands that specify an unlimited number of
arguments, for example SEARCH. Each of these arguments can be a LITERAL, for
which memory will be allocated and not released until the entire command has
been received and processed. This can run a server out of memory, with varying
consequences depending on the server's OOM policy.
.
Discovered by Damian Poddebniak.
commit:93161e7cd
commit:daa4cb210
commit:dcc88bb66
commit:333de29fd
commit:800100d1c
commit:d06d8d072
commit:7638ac52a
commit:efa3a69a8
commit:4e65061e1
commit:8414e71a9
commit:dc9846028
commit:fb0eee5f3
commit:0ed046663
commit:f37421f26
commit:cce755f3a
commit:d95b0b211		 Ken Murchison <murch@fastmail.com> not-needed upstream upstream, 2024-06-05
CVE-2024-34055-regressions-1.patch Instance: check backend sync to mupdate during murder shutdown ellie timoney <ellie@fastmail.com> not-needed upstream, https://github.com/cyrusimap/cyrus-imapd/commits/846f1f49 2024-07-29
CVE-2024-34055-regressions-2.patch imapparse: add getmstring() for mupdate-specific parsing The mupdate protocol uses LITERAL+ in server->client communications, whereas
in the IMAP protocol this is only permitted in client->server communications.
Adds a parser flag and corresponding macro to switch behaviours.
Fixes #4932		 ellie timoney <ellie@fastmail.com> not-needed upstream, https://github.com/cyrusimap/cyrus-imapd/commits/e35707e7 2024-07-29
CVE-2024-34055-regressions-3.patch sync_sieve_upload() always initialize buffer with script content Ken Murchison <murch@fastmail.com> not-needed upstream, https://github.com/cyrusimap/cyrus-imapd/commits/00d0646e 2024-07-29
CVE-2026-47082-vacation-fcc-acl.patch lmtp_sieve.c: enforce ACL on vacation :fcc destination

This is CYR-2892, CVE-2026-47082.

Enforce *some* ACL check when delivering the fcc for a vacation message!
Rather than pass aclcheck=0, pass ACL_INSERT: the script owner must be
able to write to the target mailbox.

This problem was reported by Michael Lynch (mtlynch.io).		 Ricardo Signes <rjbs@semiotic.systems> no debian upstream, https://github.com/cyrusimap/cyrus-imapd/commit/db6d646d00 2026-08-31
CVE-2026-47088-mime-nested-comment-oob.patch imap/message.c: fix heap exposure in nested MIME comment parsing

This is CYR-2882, CVE-2026-47088.

Fix out-of-bounds read in message_parse_rfc822space() when parsing RFC
822 comments that end with backslash. The backslash case would increment
p past a NUL terminator, and the subsequent loop increment would read
into adjacent heap memory.

Add bounds check after backslash handling to prevent reading past the
end of the buffer.

This problem was reported by Michael Lynch (mtlynch.io).		 Ricardo Signes <rjbs@semiotic.systems> no debian upstream, https://github.com/cyrusimap/cyrus-imapd/commit/23495997b5 2026-08-31
CVE-2026-47085-urlfetch-empty-mboxkey.patch imapd: reject URLFETCH when no mboxkey exists for the mailbox

This is CYR-2876, CVE-2026-47085.

Instead of treating "there's no mboxkey.db entry for this folder" as
indicating a zero-length key, treat a missing mboxkey entry as a
validation failure.

(Also close the mboxkey db on the previously-unclosed error paths.)

This problem reported by Matthew Horsfall.


Cherry-picked from upstream commits:
e5a1055614 cassandane: test for URLFETCH token forgery with empty mboxkey
1d39d32c3b imapd: reject URLFETCH when no mboxkey exists for the mailbox		 Ricardo Signes <rjbs@fastmailteam.com> no debian upstream, https://github.com/cyrusimap/cyrus-imapd/commit/1d39d32c3b 2026-08-31
CVE-2026-47089-listrights-admin.patch imapd: LISTRIGHTS requires admin rights

This is CYR-2872, CVE-2026-47089.

cmd_listrights was refusing only when the caller had *no* rights at
all on the target mailbox, when it should've been requiring admin
rights.

With this patch, we'll properly require ACL_ADMIN (owners and admins
still pass through), matching the check cmd_getacl already uses. When
the caller has ACL_LOOKUP but not ACL_ADMIN, return PERMISSION_DENIED;
otherwise hide the mailbox as NONEXISTENT.

This problem reported by Matthew Horsfall.


Cherry-picked from upstream commits:
5f406195f7 cassandane: test that LISTRIGHTS requires admin rights
5c97794e52 imapd: LISTRIGHTS requires admin rights		 Ricardo Signes <rjbs@fastmailteam.com> no debian upstream, https://github.com/cyrusimap/cyrus-imapd/commit/5c97794e52 2026-08-31
CVE-2026-47081-xapplepushservice-read-access.patch imapd: require read access for XAPPLEPUSHSERVICE mailboxes

This is CYR-2871, CVE-2026-47081.

Only accept a mailbox if the caller is its owner, an admin, or holds
ACL_READ. Anything else is silently skipped (no echo, no event), which
also preserves the existing "missing" behaviour for non-existent names.

This problem reported by Matthew Horsfall.


Cherry-picked from upstream commits:
1044c0b13b cassandane: test XAPPLEPUSHSERVICE leaks other users' folders
50f77bad30 imapd: require read access for XAPPLEPUSHSERVICE mailboxes		 Ricardo Signes <rjbs@fastmailteam.com> no debian upstream, https://github.com/cyrusimap/cyrus-imapd/commit/50f77bad30 2026-08-31
CVE-2026-47087-urlauth-recheck-access.patch imapd.c: re-check URLAUTH authorizer access just in time

This is CYR-2868, CVE-2026-47087.

cmd_urlfetch validated the HMAC token against the authorizer's mboxkey,
but skipped any ACL check whenever url.urlauth.access was set. Sure,
the rights existed right at that moment, but if access is revoked after
the URL is created, the URL needs to stop working. We need to just
check access JIT.


Cherry-picked from upstream commits:
be5eabb4df cassandane: tighten URLAuth ACL bypass test
fbb130b339 cassandane: fix indenting in cassandane/tiny-tests/URLAuth/perms
bdf709102c cassandane: URLAUTH must re-check authorizer ACLs at fetch time
8380d0fb3d imapd.c: re-check URLAUTH authorizer access just in time		 Ricardo Signes <rjbs@fastmailteam.com> no debian upstream, https://github.com/cyrusimap/cyrus-imapd/commit/8380d0fb3d 2026-08-31
CVE-2026-47086-genurlauth-read-access.patch imapd: require read access on mailbox in GENURLAUTH

This is CYR-2868, CVE-2026-47086.

You can't grant access to things you can't access! Without this check,
any authenticated user could mint a URLAUTH token for any mailbox they
could name, because cmd_urlfetch skipped the ACL check whenever
urlauth.access is set -- it trusts that the presence of a valid HMAC
means the authorizing user was entitled to delegate.

Require the authorizer to have at least ACL_READ on the mailbox before
issuing a token.

This problem reported by Matthew Horsfall.


Cherry-picked from upstream commits:
88d9bf6e7e cassandane: test for ACL bypass in URLAuth
e7a28ccf9b imapd: require read access on mailbox in GENURLAUTH		 Ricardo Signes <rjbs@fastmailteam.com> no debian upstream, https://github.com/cyrusimap/cyrus-imapd/commit/e7a28ccf9b 2026-08-31
CVE-2026-47084-localdelete-force.patch imapd: fix cmd_delete 'force' handling (LOCALDELETE ACL bypass)

This is CYR-2867, CVE-2026-47084.

Non-admin users could invoke the admin-only LOCALDELETE command
and delete mailboxes without permission, because MBOXLIST_DELETE_FORCE
wasn't being plumbed through to mboxlist_deletemailbox.

Reported by Michael Lynch (mtlynch.io).

Cherry-picked from upstream commits:
2c871deac5 Delete: test localdelete of other user's mailbox
304255f5be imapd: fix cmd_delete 'force' handling
7dfc43c681 MurderIMAP: localdelete requires admin privs

Adapted for 3.6.1: the upstream hunk carries an
"else if (!isadmin && mbname_issystem(mbname))" context line, but
mbname_issystem() does not exist in 3.6. The fix itself is unchanged and
is equally effective here: both mboxlist_deletemailbox() and
mboxlist_delayed_deletemailbox() already contain
"if (!isadmin && force) return IMAP_PERMISSION_DENIED;", so plumbing
MBOXLIST_DELETE_FORCE through is what turns the bypass into a denial.
The Cassandane regression tests are omitted (3.6 has no tiny-tests/).		 ellie timoney <ellie@fastmail.com> no debian upstream, https://github.com/cyrusimap/cyrus-imapd/commit/304255f5be 2026-08-31

All known versions for source package 'cyrus-imapd'

Links