Debian Patches
Status for postsrsd/1.10-2.2
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 0001-Run-as-postsrsd-user-by-default.patch | Run as postsrsd user by default | Oxan van Leeuwen <oxan@oxanvanleeuwen.nl> | not-needed | 2019-02-23 | ||
| 0002-SECURITY-Fix-DoS-on-overly-long-input-from-Postfix.patch | SECURITY: Fix DoS on overly long input from Postfix Thanks to Mateusz Jończyk who reported this issue and gave valuable feedback for its resolution. PostSRSd would hang on an overly long GET request, because the fread()/fwrite() logic in the subprocess would get confused by the remaining input line in its buffer. Theoretically, this error should never occur, as Postfix is supposed to send valid email addresses only, which are shorter than the buffer, even assuming every single character is percent-encoded. However, Postfix sometimes does seem to send malformed request with multiple concatenated email addresses. I'm not sure if there's a reliable way to trigger this condition by an external attacker, but it is a security bug in PostSRSd nevertheless. Fixes CVE-2021-35525. |
=?utf-8?q?Timo_R=C3=B6hling?= <timo@gaussglocke.de> | not-needed | https://github.com/roehling/postsrsd/commit/077be98d8c8a9847e4ae0c7dc09e7474cbe27db2 | 2021-07-14 |