interimap/Changelog, branch upstream/0.5.3

Prepare new release.

2020-12-09T14:33:15+00:00

New test with a server offering both RSA+ECDSA certificates.

2020-12-09T14:29:59+00:00

This requires dovecot-imapd 2.2.31 or later.

Certificate generated with:

      $ openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve \
            -out tests/snippets/dovecot/dovecot.ecdsa.key
      $ openssl req -x509 -days 3650 -subj "/CN=InterIMAP test suite" \
            -key tests/snippets/dovecot/dovecot.ecdsa.key \
            -out tests/snippets/dovecot/dovecot.ecdsa.crt

libinterimap: SSL_fingerprint now supports a space-separate list of digests to pin.

2020-12-09T14:29:54+00:00

And succeeds if, and only if, the peer certificate SPKI matches one of
the pinned digest values.  Specifying multiple digest values can key
useful in key rollover scenarios and/or when the server supports
certificates of different types (for instance RSA+ECDSA).

test suite: use a RSA certificate rather than ECDSA.

2020-12-09T13:57:11+00:00

It's arguably the most common use-case.  Generated with

  $ openssl genpkey -algorithm RSA -out tests/snippets/dovecot/dovecot.rsa.key
  $ openssl req -x509 -days 3650 -subj "/CN=InterIMAP test suite" \
        -key tests/snippets/dovecot/dovecot.rsa.key \
        -out tests/snippets/dovecot/dovecot.rsa.crt

libinterimap: 'debug' forces 'null-stderr' = 0.

2020-12-08T15:03:23+00:00

The standard error is never sent to /dev/null in debug mode.

Closes: deb#968392

Prepare new release.

2020-08-03T18:51:01+00:00

libinterimap: abort on PREAUTH greeting received on plaintext connections

2020-08-03T18:50:08+00:00

Set "STARTTLS = NO" to ignore.  This is similar to CVE-2020-12398 and
CVE-2020-14093.

libinterimap: Fix response injection vulnerability after STARTTLS.

2020-08-03T18:30:46+00:00

For background see https://gitlab.com/muttmua/mutt/-/issues/248 .

libinterimap: fail when a capability to ENABLE is missing from the server's CAPABILITY listing.

2020-08-03T18:29:56+00:00

Makefile: remove 'smart' extension from pandoc call to generate manuals.

2020-08-03T18:29:54+00:00