Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:dovecot
User: [email protected]
Usertags: pu
The version of dovecot currently staged for inclusion in the next trixie
point release inadvertently introduced a memory leak when backporting
upstream's fix for CVE-2026-27857.
After conversation with the security team, we decided that the leak was not
severe enough to warrant a revision to the DSA, but could instead wait for
the upcoming trixie point release. So that's what this request is about.
This change updates debian/patches/CVE-2026-27857-2.patch to remove a stray
line "id->log_reply = str_new(default_pool, 64);" It also refreshes
debian/patches/CVE-2026-27857-4.patch based on contextual changes from
updating -2.
This change also pulls in an autopkgtest that was introduced in the bookworm
update in DSA 6197 to detect a regression in that update.
debdiff is attached.
noah
diff -Nru dovecot-2.4.1+dfsg1/debian/changelog
dovecot-2.4.1+dfsg1/debian/changelog
--- dovecot-2.4.1+dfsg1/debian/changelog2026-03-31 15:07:17.0
-0400
+++ dovecot-2.4.1+dfsg1/debian/changelog2026-05-06 15:18:43.0
-0400
@@ -1,3 +1,10 @@
+dovecot (1:2.4.1+dfsg1-6+deb13u5) trixie; urgency=medium
+
+ * [b357180] autopkgtests: Add managesieved authentication test
+ * [c9d69a1] Fix memory leak in CVE-2026-27857 fix
+
+ -- Noah Meyerhans Wed, 06 May 2026 15:18:43 -0400
+
dovecot (1:2.4.1+dfsg1-6+deb13u4) trixie-security; urgency=medium
* [bc29057] CVE-2025-59028: auth: Don't disconnect auth client when
diff -Nru dovecot-2.4.1+dfsg1/debian/patches/CVE-2026-27857-2.patch
dovecot-2.4.1+dfsg1/debian/patches/CVE-2026-27857-2.patch
--- dovecot-2.4.1+dfsg1/debian/patches/CVE-2026-27857-2.patch 2026-03-31
15:07:17.0 -0400
+++ dovecot-2.4.1+dfsg1/debian/patches/CVE-2026-27857-2.patch 2026-05-05
20:14:11.0 -0400
@@ -20,8 +20,10 @@
src/plugins/virtual/virtual-config.c | 2 +-
13 files changed, 30 insertions(+), 19 deletions(-)
dovecot-2.4.1+dfsg1.orig/src/imap-login/imap-login-client.c
-+++ dovecot-2.4.1+dfsg1/src/imap-login/imap-login-client.c
+Index: dovecot/src/imap-login/imap-login-client.c
+===
+--- dovecot.orig/src/imap-login/imap-login-client.c
dovecot/src/imap-login/imap-login-client.c
@@ -382,7 +382,7 @@ static int imap_client_create(struct cli
imap_client->parser =
imap_parser_create(imap_client->common.input,
@@ -40,21 +42,24 @@
/* CRLF is lost from buffer when streams are reopened. */
imap_client->skip_line = FALSE;
dovecot-2.4.1+dfsg1.orig/src/imap-login/imap-login-cmd-id.c
-+++ dovecot-2.4.1+dfsg1/src/imap-login/imap-login-cmd-id.c
-@@ -346,7 +346,9 @@ int cmd_id(struct imap_client *client)
+Index: dovecot/src/imap-login/imap-login-cmd-id.c
+===
+--- dovecot.orig/src/imap-login/imap-login-cmd-id.c
dovecot/src/imap-login/imap-login-cmd-id.c
+@@ -346,7 +346,8 @@ int cmd_id(struct imap_client *client)
id->params->pool = param_pool;
id->parser = imap_parser_create(client->common.input,
client->common.output,
- IMAP_LOGIN_MAX_LINE_LENGTH);
+ IMAP_LOGIN_MAX_LINE_LENGTH,
+ NULL);
-+ id->log_reply = str_new(default_pool, 64);
if (client->set->imap_literal_minus)
imap_parser_enable_literal_minus(id->parser);
parser_flags = IMAP_PARSE_FLAG_STOP_AT_LIST;
dovecot-2.4.1+dfsg1.orig/src/imap/cmd-append.c
-+++ dovecot-2.4.1+dfsg1/src/imap/cmd-append.c
+Index: dovecot/src/imap/cmd-append.c
+===
+--- dovecot.orig/src/imap/cmd-append.c
dovecot/src/imap/cmd-append.c
@@ -1063,7 +1063,8 @@ static bool cmd_append_full(struct clien
o_stream_unset_flush_callback(client->output);
@@ -65,8 +70,10 @@
if (client->set->imap_literal_minus)
imap_parser_enable_literal_minus(ctx->save_parser);
dovecot-2.4.1+dfsg1.orig/src/imap/cmd-setmetadata.c
-+++ dovecot-2.4.1+dfsg1/src/imap/cmd-setmetadata.c
+Index: dovecot/src/imap/cmd-setmetadata.c
+===
+--- dovecot.orig/src/imap/cmd-setmetadata.c
dovecot/src/imap/cmd-setmetadata.c
@@ -289,7 +289,8 @@ cmd_setmetadata_start(struct imap_setmet
asynchronously the same way as APPEND does. */
client->input_lock = cmd;
@@ -77,8 +84,10 @@
if (client->set->imap_literal_minus)
imap_parser_enable_literal_minus(ctx->parser);
