From af6ea3f0b0122100a121bde640c9ff04094e6ce8 Mon Sep 17 00:00:00 2001 From: Michal Hlavinka Date: Mon, 3 Aug 2026 08:49:22 +0200 Subject: [PATCH] increase SASL auth buffer size for large Kerberos tickets also rebuild needed for RHEL-188469 Resolves: RHEL-188469 Resolves: RHEL-155444 --- dovecot-2.3-tokensize.patch | 12 ++++++++++++ dovecot.spec | 9 ++++++++- 2 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 dovecot-2.3-tokensize.patch diff --git a/dovecot-2.3-tokensize.patch b/dovecot-2.3-tokensize.patch new file mode 100644 index 0000000..d67e47f --- /dev/null +++ b/dovecot-2.3-tokensize.patch @@ -0,0 +1,12 @@ +diff -up dovecot-2.3.21/src/login-common/client-common.h.tokensize dovecot-2.3.21/src/login-common/client-common.h +--- dovecot-2.3.21/src/login-common/client-common.h.tokensize ++++ dovecot-2.3.21/src/login-common/client-common.h +@@ -26,7 +26,7 @@ + #define LOGIN_MAX_OUTBUF_SIZE 4096 + + /* Max. length of SASL authentication buffer. */ +-#define LOGIN_MAX_AUTH_BUF_SIZE 8192 ++#define LOGIN_MAX_AUTH_BUF_SIZE 65536 + + /* Disconnect client after this many milliseconds if it hasn't managed + to log in yet. */ diff --git a/dovecot.spec b/dovecot.spec index bfd1c14..bd39c0a 100644 --- a/dovecot.spec +++ b/dovecot.spec @@ -6,7 +6,7 @@ Name: dovecot Epoch: 1 Version: 2.3.21 %global prever %{nil} -Release: 20%{?dist} +Release: 21%{?dist} #dovecot itself is MIT, a few sources are PD, pigeonhole is LGPLv2 License: MIT AND LGPL-2.1-only @@ -92,6 +92,9 @@ Patch36: dovecot-2.3-cve-2026-27857p5of5.patch # https://github.com/dovecot/core/commit/9a0f8c1066956ea7450ca82b57f904332006a502 Patch37: dovecot-2.3-cve-2026-42006.patch +# sent upstream, RHEL-155444 +Patch38: dovecot-2.3-tokensize.patch + BuildRequires: gcc, gcc-c++, openssl-devel, pam-devel, zlib-devel, bzip2-devel, libcap-devel BuildRequires: libtool, autoconf, automake, pkgconfig BuildRequires: sqlite-devel @@ -206,6 +209,7 @@ mv dovecot-2.3-pigeonhole-%{pigeonholever} dovecot-pigeonhole %patch -P 35 -p1 -b .cve-2026-27857p4of5 %patch -P 36 -p1 -b .cve-2026-27857p5of5 %patch -P 37 -p1 -b .cve-2026-42006 +%patch -P 38 -p1 -b .tokensize cp run-test-valgrind.supp dovecot-pigeonhole/ # valgrind would fail with shell wrapper echo "testsuite" >dovecot-pigeonhole/run-test-valgrind.exclude @@ -566,6 +570,9 @@ make check %{_libdir}/%{name}/dict/libdriver_pgsql.so %changelog +* Mon Aug 03 2026 Michal Hlavinka - 1:2.3.21-21 +- increase SASL auth buffer size for large Kerberos tickets (RHEL-155444) + * Tue Jul 21 2026 RHEL Packaging Agent - 1:2.3.21-20 - fix CVE-2026-42006: fix imap_parser list_count_limit to actually work (RHEL-188469)