Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package OpenSMTPD for openSUSE:Factory checked in at 2026-09-15 12:49:25 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/OpenSMTPD (Old) and /work/SRC/openSUSE:Factory/.OpenSMTPD.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "OpenSMTPD" Tue Sep 15 12:49:25 2026 rev:5 rq:1377987 version:7.9.0p0 Changes: -------- --- /work/SRC/openSUSE:Factory/OpenSMTPD/OpenSMTPD.changes 2026-08-04 21:39:38.063116031 +0200 +++ /work/SRC/openSUSE:Factory/.OpenSMTPD.new.383539/OpenSMTPD.changes 2026-09-15 12:49:27.826543184 +0200 @@ -1,0 +2,42 @@ +Mon Sep 14 16:33:53 UTC 2026 - Mislav Bozicevic <[email protected]> + +- Updated to version 7.9.0p0: + - Includes OpenBSD 7.9 errata `002` and `015` + - Restricted the characters allowed through when expanding variables with + the raw modifier, both in the MDA command line and in its environment. + - Don't lowercase K_AUTH lookups. The lookup key is "user:password", so + passwords were being case-flattened before reaching the table. + - Reject CR and LF in the sender, recipients and DSN options taken from + the sendmail(8) command line, which could otherwise inject additional + SMTP commands into the local dialogue. + - Reject empty or slash-bearing usernames before building the mbox path. + - Fixed a possible out of bounds access in dname_expand(). + - Fixed a possible out of bounds read in text_to_netaddr(). + - Stop parsing DNS answers once unpack_rr() reports a failure, instead of + looping on the attacker-controlled answer count. + - Validate encrypted queue buffer sizes before processing the auth tag and + IV data. + - Hardened the privsep environment: reject oversized sockaddr payloads + received over IPC, clear userinfo before sending it over imsg, zero the + temporary envelope parsing buffers, and drop pending asynchronous lookup + references when a session is torn down. + - EHLO now resets the transaction, as required by RFC 5321. + - Return 452 instead of 451 when there are too many recipients. + - "smtp limit max-rcpt" now requires a value of at least 100, per RFC 5321. + - Removed "support" for the WIZ command. + - Fixed using modifiers together with partial expansion in format + specifiers, for example %{sender.user[6:]:strip}. + - Fixed a leak of the inflate stream on every read from a compressed queue. + - Fixed leaks of mda_subaddress and dispatcher in mda_envelope_free(), and + of the copied envelope on the smarthost lookup failure path. + - Unlink the transformed temporary file on every queue commit failure, + instead of leaving orphaned .comp/.enc files behind. + - Updated the bundled imsg and switched smtpd over to imsgbuf_get(). + - Various documentation improvements. + - A configuration setting "smtp limit max-rcpt" below 100 is now rejected + at parse time. + - The set of characters accepted in envelope addresses no longer includes + $ ` { | } , which are never present in legitimate addresses and are + commonly seen in exploit attempts. + +------------------------------------------------------------------- Old: ---- opensmtpd-7.8.0p1.tar.gz New: ---- opensmtpd-7.9.0p0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ OpenSMTPD.spec ++++++ --- /var/tmp/diff_new_pack.BrfTKw/_old 2026-09-15 12:49:29.304605014 +0200 +++ /var/tmp/diff_new_pack.BrfTKw/_new 2026-09-15 12:49:29.305605055 +0200 @@ -19,7 +19,7 @@ Name: OpenSMTPD %global name_lowercase %(echo -n "%{name}" | tr '[:upper:]' '[:lower:]') -Version: 7.8.0p1 +Version: 7.9.0p0 Release: 0 Summary: A free implementation of the server-side SMTP protocol License: BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause AND ISC ++++++ opensmtpd-7.8.0p1.tar.gz -> opensmtpd-7.9.0p0.tar.gz ++++++ ++++ 55045 lines of diff (skipped)
