Bug 380453 – <net-mail/fetchmail-6.3.21 NULL-byte-insertion bug in the IMAP client

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Eray Aslan 2011-08-24 09:34:14 UTC]

Release Name: 6.3.21

Notes:

This release fixes a NUL-byte-insertion bug in the IMAP client that occurs when the last line of the input has no LF- and no CRLF-termination.

It fixes that by adding a CRLF sequence. This has no impact on messages ending up in mbox-format mailboxes, but adds this excess CRLF in Maildir(++) stores.

Changes:
fetchmail-6.3.21 (released 2011-08-21, 26011 LoC):

# CRITICAL BUG FIX
* The IMAP client no longer inserts NUL bytes into the last line of a message
  when it is not closed with a LF or CRLF sequence. Reported by Antoine Levitt.
  As a side effect of the fix, and in order to avoid a full rewrite, fetchmail
  will now CRLF-terminate the last line fetched through IMAP, even if it is
  originally not terminated by LF or CRLF. This bears no relevance if your
  messages end up in mbox, but adds line termination for storages (like Maildir)
  that do not require that the last line be LF- or CRLF-terminated.

# CONTRIB/ addition
* There is a patch against fetchnews's source, contrib/rawlog.patch, that can
  log (and hexdump non-printing characters) raw socket data to a file. It proved
  useful to debug Antoine's bug described above.

Reproducible: Always




We should stabilize =net-mail/fetchmail-6.3.21

[Comment 1 Agostino Sarubbo 2011-08-24 12:15:40 UTC]

Thanks Eray,

If you say "ok", we can go ahead to stabilize it.

[Comment 2 Eray Aslan 2011-08-25 05:20:27 UTC]

Yes, we should go ahead and stabilize =net-mail/fetchmail-6.3.21.  That was the point of my last sentence above.

[Comment 3 Tim Sammut (RETIRED) 2011-08-25 13:23:23 UTC]

Arches, please test and mark stable:
=net-mail/fetchmail-6.3.21
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"

[Comment 4 Jeroen Roovers (RETIRED) 2011-08-25 15:20:22 UTC]

Stable for HPPA.

[Comment 5 Agostino Sarubbo 2011-08-25 17:05:09 UTC]

amd64 ok

[Comment 6 Kacper Kowalik (Xarthisius) (RETIRED) 2011-08-25 17:45:28 UTC]

ppc/ppc64 stable

[Comment 7 Markos Chandras (RETIRED) 2011-08-26 14:24:12 UTC]

amd64 done. Thanks Agostino

[Comment 8 Thomas Kahle (RETIRED) 2011-08-26 15:55:38 UTC]

x86 stable. Thanks

[Comment 9 Raúl Porcel (RETIRED) 2011-08-27 11:30:34 UTC]

alpha/arm/ia64/s390/sh/sparc stable

[Comment 10 Tim Sammut (RETIRED) 2011-08-27 16:05:48 UTC]

Thanks, folks. Vote: no.

[Comment 11 Alex Legler (RETIRED) 2011-08-27 16:12:49 UTC]

NO too. Closing noglsa.