fixes CVE-2020-7046: Truncated UTF-8 can be used to DoS
submission-login and lmtp processes.
fixes CVE-2020-7957: Specially crafted mail can crash snippet generation.
fixes CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte
when scanning data in quoted strings, leading to out of bounds heap
memory writes
doveconf hides more secrets now in the default output
NUL bytes in mail headers can cause truncated replies when fetched.
virtual plugin: Some searches used 100% CPU for many seconds
dsync assert-crashed with acl plugin in some situations.
imapc: Fixed various assert-crashes when reconnecting to server.
doveadm: Fix crash in proxying (or dsync replication) if remote is
running older than v2.2.33
auth: Fix memory leak in %{ldap_dn}
dict-sql: Fix data types to work correctly with Cassandra
Added %{if}, see https://wiki2.dovecot.org/Variables#Conditionals
sdbox: Mails were always opened when expunging, unless
mail_attachment_fs was explicitly set to empty.
lmtp/doveadm proxy: hostip passdb field was ignored, which caused
unnecessary DNS lookups if host field wasn't an IP
lmtp proxy: Fix crash when receiving unexpected reply in RCPT TO
quota_clone: Update also when quota is unlimited (broken in v2.2.31)
mbox, zlib: Fix assert-crash when accessing compressed mbox
doveadm director kick -f parameter didn't work
doveadm director flush <host> resulted flushing all hosts, if <host>
wasn't an IP address.
director: Various fixes to handling backend/director changes at
abnormal times, especially while ring was unsynced.
director: Use less CPU in imap-login processes when moving/kicking
many users.
lmtp: Session IDs were duplicated/confusing with multiple RCPT TOs
when lmtp_rcpt_check_quota=yes
LDA Sieve plugin: Fixed sequential execution of LDAP-based scripts. A
missing LDAP-based script could cause the script sequence to exit earlier.
sieve-filter: Removed the (now) duplicate utf8 to mutf7 mailbox name
conversion. This caused problems with mailbox names containing UTF-8
characters.
Made the retention period for redirect duplicate identifiers
configurable. Changed the default retention period from 24 to 12 hours.
sieve-filter: Fixed memory leak: forgot to clean up script binary at
end of execution
managesieve-login: Fixed handling of AUTHENTICATE command. A second
authenticate command would be parsed wrong.
Modseq tracking didn't always work correctly. This could have caused
imap unhibernation to fail or IMAP QRESYNC/CONDSTORE extensions to
not work perfectly.
mdbox: "Inconsistency in map index" wasn't fixed automatically
dict-ldap: %variable values used in the LDAP filter weren't escaped.
quota=count: quota_warning = -storage=.. was never executed (try #2).
imapc: >= 32 kB mail bodies were supposed to be cached for subsequent
FETCHes, but weren't.
quota-status service didn't support recipient_delimiter
acl: Don't access dovecot-acl-list files with acl_globals_only=yes
mail_location: If INDEX dir is set, mailbox deletion deletes its
childrens' indexes.
director: v2.2.31 caused rapid reconnection loops to directors
that were down.
