From cf1e46723a76565c0a9dbf682f6dfd7a68882452 Mon Sep 17 00:00:00 2001 From: "andre.peters" Date: Thu, 1 Feb 2018 23:37:10 +0100 Subject: [PATCH] [Dovecot] Fixes CVE-2017-15132 - take 2 --- data/Dockerfiles/dovecot/Dockerfile | 4 +++- docker-compose.yml | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/data/Dockerfiles/dovecot/Dockerfile b/data/Dockerfiles/dovecot/Dockerfile index aec56676..8afb72d6 100644 --- a/data/Dockerfiles/dovecot/Dockerfile +++ b/data/Dockerfiles/dovecot/Dockerfile @@ -65,7 +65,9 @@ RUN apt-get update && apt-get -y --no-install-recommends install \ RUN curl https://www.dovecot.org/releases/2.2/dovecot-$DOVECOT_VERSION.tar.gz | tar xvz \ && cd dovecot-$DOVECOT_VERSION \ - && sed '/call_callback(request, AUTH_REQUEST_STATUS_ABORT, NULL, NULL);/a pool_unref(&request->pool);' src/lib-auth/auth-client-request.c \ + && curl -o src/lib-auth/auth-client-request.c https://mailcow.email/dovecot-patch1/auth-client-request.c \ + && curl -o src/lib-auth/auth-server-connection.c https://mailcow.email/dovecot-patch1/auth-server-connection.c \ + && curl -o src/lib-auth/auth-server-connection.h https://mailcow.email/dovecot-patch1/auth-server-connection.h \ && ./configure --with-mysql --with-lzma --with-lz4 --with-ssl=openssl --with-notify=inotify --with-storages=mdbox,sdbox,maildir,mbox,imapc,pop3c --with-bzlib --with-zlib \ && make -j3 \ && make install \ diff --git a/docker-compose.yml b/docker-compose.yml index dfa5cba7..23d16949 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -163,7 +163,7 @@ services: - sogo dovecot-mailcow: - image: mailcow/dovecot:1.19 + image: mailcow/dovecot:1.20 build: ./data/Dockerfiles/dovecot cap_add: - NET_BIND_SERVICE