Hello,
Same problem reported here last week. On my production server with
3.8.1-1~bpo12+1 Debian's bookworm backport package:
https://cyrus.topicbox.com/groups/info/Tfa45b4c4b5affc7d/couldnt-do-list-command-on-mupdate-serverupgrade-murder-cluster-from-3-2-to-3-8
Subject report only the second problem with 3.8.3 on my test cluster.
Not yet tested in production with 3.8.3 and the last patch, but I
should have the same result.
Jean Charles Delépine
Quoting Stephan Lauffer <lauffer@xxxxxxxxxxxxxx>:
Dear Ellie,
thank's a lot for working on the patch.
We uses builds from
https://download.opensuse.org/repositories/home:/buschmann23 and
Matthias was so kind to add your patch to a branch for 3.4 and 3.8.
In our murder (atm all productive running on 3.4.7) I have two 3.8
backends. They only have a few boxes and there the patch worked fine.
But poorly it failed on a poduktive 3.4 (productive 3.4.7 and tested
3.4.8 with the patch). There we have about 6k users, ctl_mboxlist -v
| wc -l says 82684.
'clt_mailboxlist -m' exits with a " fatal error: mupdate said not us
before it said us".
I remember that I read a "said not us before it said us" years/months ago...
So at the moment I can not say that everything is fine now. Hm... :/
Matthias Fehring <buschmann@xxxxxxxxxxxxxxxxxx>
Zitat von ellie timoney <ellie@xxxxxxxxxxxx>:
Hi,
We've become aware that the fixes for CVE-2024-34055 break
communications with the mupdate service in Cyrus Murder deployments
(https://github.com/cyrusimap/cyrus-imapd/issues/4932)
We're working on a fix, and will publish new releases when it's
ready. Murder deployments should avoid upgrading to the current
versions, and wait for the next set of releases instead.
Sorry for the inconvenience,
ellie
On Wed, 5 Jun 2024, at 12:41 PM, ellie timoney wrote:
The Cyrus team is proud to announce the immediate availability of
new versions of Cyrus IMAP: 3.8.3, 3.6.5, and 3.4.8
These releases contain a fix for CVE-2024-34055
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34055>.
From the release notes:
Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow authenticated
attackers to cause unbounded memory allocation by sending many
LITERALs in a single command.
The IMAP protocol allows for command arguments to be LITERALs of
negotiated length, and for these the server allocates memory to
receive the content before instructing the client to proceed. The
allocated memory is released when the whole command has been
received and processed.
The IMAP protocol has a number commands that specify an unlimited
number of arguments, for example SEARCH. Each of these arguments
can be a LITERAL, for which memory will be allocated and not
released until the entire command has been received and
processed. This can run a server out of memory, with varying
consequences depending on the server's OOM policy.
Discovered by Damian Poddebniak.
This issue affects all previous Cyrus IMAP releases.
The updated versions introduce two new imapd.conf limits
(maxargssize, maxliteral) that operators can configure with safe
values for their environment. Please see the release notes and
other documentation for full details.
These changes were too intrusive to backport to any earlier
versions. If you are running Cyrus IMAP version 3.2 or earlier,
we suggest upgrading to at least 3.4.8, especially if your service
has untrusted users.
Release notes:
https://www.cyrusimap.org/3.8/imap/download/release-notes/3.8/x/3.8.3.html
https://www.cyrusimap.org/3.6/imap/download/release-notes/3.6/x/3.6.5.html
https://www.cyrusimap.org/3.4/imap/download/release-notes/3.4/x/3.4.8.html
Download URLs:
https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.8.3/cyrus-imapd-3.8.3.tar.gz
https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.8.3/cyrus-imapd-3.8.3.tar.gz.sig
https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.6.5/cyrus-imapd-3.6.5.tar.gz
https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.6.5/cyrus-imapd-3.6.5.tar.gz.sig
https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.8/cyrus-imapd-3.4.8.tar.gz
https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.8/cyrus-imapd-3.4.8.tar.gz.sig
On behalf of the Cyrus team,
ellie timoney
*Cyrus <https://cyrus.topicbox.com/latest>* / Announce / see
discussions <https://cyrus.topicbox.com/groups/announce> +
participants <https://cyrus.topicbox.com/groups/announce/members>
+ delivery options
<https://cyrus.topicbox.com/groups/announce/subscription>
Permalink
<https://cyrus.topicbox.com/groups/announce/Ta8e3998446caf7f8-M391040654da3fceae98932e3>
--
Liebe Gruesse, with best regards
Stephan Lauffer
Pedagogical University Freiburg - Germany
http://www.ph-freiburg.de/zik/
Fon/ Fax: +49 761 682 -559/ -486
--
Service systèmes et réseaux - DISI
Université de Picardie Jules Verne
5, rue du moulin neuf - 80000 Amiens
------------------------------------------
Cyrus: Info
Permalink: https://cyrus.topicbox.com/groups/info/Ta8e3998446caf7f8-M791002b2339bcc1afbf700cf
Delivery options: https://cyrus.topicbox.com/groups/info/subscription
