From owner-freebsd-ports-bugs@FreeBSD.ORG Thu May 8 16:40:00 2014 Return-Path: Delivered-To: freebsd-ports-bugs@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 99ECC235 for ; Thu, 8 May 2014 16:40:00 +0000 (UTC) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 76540795 for ; Thu, 8 May 2014 16:40:00 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.8/8.14.8) with ESMTP id s48Ge0ta037690 for ; Thu, 8 May 2014 16:40:00 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.8/8.14.8/Submit) id s48Ge0U0037689; Thu, 8 May 2014 16:40:00 GMT (envelope-from gnats) Resent-Date: Thu, 8 May 2014 16:40:00 GMT Resent-Message-Id: <201405081640.s48Ge0U0037689@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Paul J Murphy Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 8B746217; Thu, 8 May 2014 16:38:55 +0000 (UTC) Received: from srv00.inetstat.net (srv00.inetstat.net [IPv6:2001:41d0:1:dbae::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 2017A784; Thu, 8 May 2014 16:38:55 +0000 (UTC) Received: from srv00.inetstat.net (localhost [127.0.0.1]) by srv00.inetstat.net (Postfix) with ESMTP id DDD4BD78A3; Thu, 8 May 2014 16:38:52 +0000 (UTC) Received: from srv00.inetstat.net ([IPv6:::1]) by srv00.inetstat.net (srv00.inetstat.net [IPv6:::1]) (amavisd-new, port 10026) with ESMTP id lA1sfaaWTLAp; Thu, 8 May 2014 16:38:51 +0000 (UTC) Received: by srv00.inetstat.net (Postfix, from userid 0) id 85D03D78A0; Thu, 8 May 2014 16:38:51 +0000 (UTC) Message-Id: <20140508163851.85D03D78A0@srv00.inetstat.net> Date: Thu, 8 May 2014 16:38:51 +0000 (UTC) From: Paul J Murphy To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: ports/189479: [PATCH] security/amavisd-new: update to 2.8.1,1 Cc: gabor@FreeBSD.org X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 May 2014 16:40:00 -0000 >Number: 189479 >Category: ports >Synopsis: [PATCH] security/amavisd-new: update to 2.8.1,1 >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: update >Submitter-Id: current-users >Arrival-Date: Thu May 08 16:40:00 UTC 2014 >Closed-Date: >Last-Modified: >Originator: Paul J Murphy >Release: FreeBSD 10.0-RELEASE-p2 amd64 >Organization: iNetStat.net >Environment: System: FreeBSD srv00.inetstat.net 10.0-RELEASE-p2 FreeBSD 10.0-RELEASE-p2 #0 r265140: Wed Apr 30 12:18:59 UTC >Description: - Update to 2.8.1,1 (v2.8.1 was released on June 28, 2013) - 2.8.0 has a nasty sounding bug which can cause silent loss of messages http://www.amavis.org/release-notes.txt says for 2.8.1: ... - fixed a bug in the SMTP client code, where the final SMTP status did not reflect a failure status of a DATA command from a back-end MTA. This caused a reception of a mail message to be confirmed but a message was then lost, as it could not be passed to a back-end MTA. The bug went unnoticed for years, as the commonly used MTAs normally reject either at the MAIL FROM, at RCPT TO, or at the data-dot stage, but not at the DATA command. Reported by Deniska-rediska; ... Depends versions updated according to the obvious changes in the docs, but it's possible that I may not have caught them all. The original docs are also vague in places over minimum versions, lots of refs to "latest" or similar. It seems to work nicely enough on 10.0 with all relevant ports up to date with their stable branches/releases. Depends version for "file" checked for the inconsistency between the comment and the rule (> vs. >=). According to info on the web, 4.21 should be the fix for the security hole in 4.20 and earlier - i.e. the rule was correct, but the comment was wrong. Port maintainer (gabor@FreeBSD.org) is cc'd. Generated with FreeBSD Port Tools 1.02 (mode: update, diff: SVN) >How-To-Repeat: >Fix: --- amavisd-new-2.8.1.patch begins here --- Index: Makefile =================================================================== --- Makefile (revision 353329) +++ Makefile (working copy) @@ -1,8 +1,8 @@ # $FreeBSD$ PORTNAME= amavisd-new -PORTVERSION= 2.8.0 -PORTREVISION= 2 +PORTVERSION= 2.8.1 +PORTREVISION= 0 PORTEPOCH= 1 CATEGORIES= security MASTER_SITES= http://www.ijs.si/software/amavisd/ \ @@ -18,11 +18,11 @@ p5-MIME-Tools>=0:${PORTSDIR}/mail/p5-MIME-Tools \ p5-Convert-TNEF>=0:${PORTSDIR}/converters/p5-Convert-TNEF \ p5-Convert-UUlib>=1.08,1:${PORTSDIR}/converters/p5-Convert-UUlib \ - p5-Archive-Zip>=0:${PORTSDIR}/archivers/p5-Archive-Zip \ - p5-Net-Server>=0.93:${PORTSDIR}/net/p5-Net-Server \ + p5-Archive-Zip>=1.14:${PORTSDIR}/archivers/p5-Archive-Zip \ + p5-Net-Server>=2.0:${PORTSDIR}/net/p5-Net-Server \ p5-Mail-DKIM>=0.33:${PORTSDIR}/mail/p5-Mail-DKIM -USES= perl5 +USES= perl5 tar:xz USE_PERL5= run NO_BUILD= yes @@ -135,7 +135,7 @@ .endif .if ${PORT_OPTIONS:MFILE} -# security fix, file > 4.21 needed +# security fix, file >= 4.21 needed RUN_DEPENDS+= file>=4.21:${PORTSDIR}/sysutils/file .endif Index: distinfo =================================================================== --- distinfo (revision 353329) +++ distinfo (working copy) @@ -1,2 +1,2 @@ -SHA256 (amavisd-new-2.8.0.tar.gz) = 342b805f58db667b099a85863328b3fdfe9c575a22ace119d541e5f12bee63ac -SIZE (amavisd-new-2.8.0.tar.gz) = 1007952 +SHA256 (amavisd-new-2.8.1.tar.xz) = 6e333a70adbd24ec52202700059fbf133e20b3c3bf5ec6f4bb10f9a2f25ea82e +SIZE (amavisd-new-2.8.1.tar.xz) = 731816 --- amavisd-new-2.8.1.patch ends here --- >Release-Note: >Audit-Trail: >Unformatted: