From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 89500 invoked by alias); 20 Aug 2019 18:02:08 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 89492 invoked by uid 89); 20 Aug 2019 18:02:08 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-7.6 required=5.0 tests=BAYES_00,FREEMAIL_FROM,GIT_PATCH_2,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.1 spammy= X-HELO: mout.gmx.net Received: from mout.gmx.net (HELO mout.gmx.net) (212.227.17.20) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Tue, 20 Aug 2019 18:02:06 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.net; s=badeba3b8450; t=1566324124; bh=Zk89FTPKvLCpaacPyNtMaKlVFGpyyWuEpN9zh8bqvyA=; h=X-UI-Sender-Class:To:From:Subject:Date; b=A9gyPHYgN0lQOywTJP8OjLo5I7PRskO1DVPeNF57AZGGkW66BvWWhkPpxpD9cYVEg So+quU7OAM/wyMPEvQ4IZyWuVFKqlpNiRoKc4PfHFqfhSVyMKw1YvuOjElmj1GypYV AvJheBpN91nfrNYX9k4YC3HMoE5VPJYWaoxFuh6c= X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c Received: from mandree.no-ip.org ([84.160.52.178]) by mail.gmx.com (mrgmx103 [212.227.17.168]) with ESMTPSA (Nemesis) id 0LgqEs-1idGcx3Vgc-00oGTi for ; Tue, 20 Aug 2019 19:49:21 +0200 Received: from ryzen.an3e.de (localhost [IPv6:::1]) by ryzen.an3e.de (Postfix) with ESMTP id 2EDCD12009D for ; Tue, 20 Aug 2019 19:49:23 +0200 (CEST) To: cygwin@cygwin.com From: Matthias Andree Openpgp: preference=signencrypt Subject: HEADS UP package "fetchmail" vulnerable and 6.4.0 release candidate out Message-ID: <18a325b3-0934-0e7f-aa6b-45828ae03ce7@gmx.de> Date: Tue, 20 Aug 2019 19:44:00 -0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-SW-Source: 2019-08/txt/msg00293.txt.bz2 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Corinna, and everyone else who is interested, checking , I see that Cygwin packages a very old fetchmail version that has unfixed security vulnerabilities and unfixed critical (data loss) bugs. Constructively moving forward, please: 1. I am about to release 6.4.0 in a few weeks' time with a few important SSL/TLS/OpenSSL updates that permit newer OpenSSL versions, require OpenSSL v1.0.2, and practically permit TLS v1.3 if linked against a sufficiently new OpenSSL. We're shy of 200 commits since the last formal release 6.3.26, and 276 changes past 6.3.21, the younger x86 (32bit) package for Cygwin. High-level details in the NEWS file linked below. Care was taken to not break the interfaces too hard, but in the sense of security, I carefully changed --sslproto semantics and flipped the switch 2. Note that fetchmail has seen several SECURITY and CRITICAL bug fixes since 6.3.21/6.3.22. Review for details, and look for these two capitalized words. 3. Please try to package 6.4.0.rc2 for x86 and x86_64 against Cygwin's libssl1.1, and see if you find any portability issues that would require fixing before 6.4.0. Deadline end of August 2019, and unless really needed for non-trivial code changes, rc2 is also the planned final candidate. Source tarballs and detached ASCII-armored GnuPG signatures at . Thanks for your consideration. Regards, Matthias Andree - upstream fetchmail maintainer -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAl1cMpoACgkQ5BKxVu/z hVrMORAAtRXCpG6lTsZNdPuu5NDquyWia6sfzptFl7FaNoD8cB2hTsoS7lBgW0VQ ulL2Y1xYdR4+JCg0i7656ZQhzpVM2qKnect4oFFfo5mx1vkrQYQQMiB3FACPF3zU OItP7nEngfmL30aDynYkrPH1+P4BY8GyZHML6KnD53jKNu5ZZBijGztV0HYjjAUd Nhmxm5GdF5uB1V6v4/c8cXDEf2xBdgMwBiU02YPLVI/8zixZR3EXLdNVcggl0Qbm 5+xe4oTw6EqY2VxUm9obs/U17bWm/10afcmm6ioo0xUXSTq5asF+2HD5WipHuhiW Zm/PPK6SVOwi32M2gzXqb3ZDqtuH9byUKZQw+LGVePsjrU1jU8F84c+5iq35g1RX TCloJWckBdflXR4Jda6yvlZstm6pd1PnQVXdw5Wl1Nwb+wAvEbV++dIvCbZuRKgI kEZBUOApyI8J0LMalxCyGAIykY+VLDsFSbcgCDuAFvrjpIyBBcKC2z0x2Y4gpxSS q4oLhTdjv+WUbVHBwN/NjroMhoNrX7zpFnGQFFjK2zVlSMMR+/aIsUUTX0v6aXZk WMMRrhtE1wiIgn7fqgxJ5oukz1Cp5qKB8NIIt5g+VgvZPpwuXXiaZ5Hw81wENzaL VN998lBF3q3K6+VDhmvdXFcilrgW5XnMoPOfTqlDKXYV5G8KY6k=3D =3Dv7yh -----END PGP SIGNATURE----- -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple