f838a05fb9
CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens, if attacker has local access. CVE-2021-33515: On-path attacker could have injected plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client. Add TSLv1.3 support to min_protocols. Allow configuring ssl_cipher_suites. (for TLSv1.3+)
21 lines
528 B
Diff
21 lines
528 B
Diff
diff -up dovecot-2.3.15/run-test-valgrind.supp.valbasherr dovecot-2.3.15/run-test-valgrind.supp
|
|
--- dovecot-2.3.15/run-test-valgrind.supp.valbasherr 2021-06-21 22:52:53.272707239 +0200
|
|
+++ dovecot-2.3.15/run-test-valgrind.supp 2021-06-21 22:54:19.786668430 +0200
|
|
@@ -1,4 +1,16 @@
|
|
{
|
|
+ <bashagin>
|
|
+ Memcheck:Leak
|
|
+ match-leak-kinds: definite
|
|
+ fun:malloc
|
|
+ fun:make_if_command
|
|
+ fun:yyparse
|
|
+ fun:parse_command
|
|
+ fun:read_command
|
|
+ fun:reader_loop
|
|
+ fun:main
|
|
+}
|
|
+{
|
|
<bash>
|
|
Memcheck:Leak
|
|
fun:malloc
|