Package: dovecot-core
Version: 1:2.4.5+dfsg1-2
Severity: important
Tags: security
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>

Dear Maintainer,

AFAICT the upstream fix for CVE-2026-40017 [0] relies on a new keyed
xxh64 strmap format v2, but the v1 → v2 on-disk upgrade only happens
when `dovecot_storage_version` is set to 2.4.5 or later:

https://github.com/dovecot/core/commit/d34ac20f89bef60f91cd898e431018ee57061125#diff-961059ca1c2993805f95ac5427aefdfea627c13a2c3476855fd859888a522cf0

However /etc/dovecot/dovecot.conf from 1:2.4.5+dfsg1-2 contains the
following two lines

    dovecot_config_version = 2.4.0
    dovecot_storage_version = 2.4.0

so AFAICT existing installations keep using  crc32 hashes and remain
affected by the denial of service issue.  X-Debbugs-Cc'ing secteam as
heads up: for the backports to older suites it might make sense to lower
the version threshold.  (Given 2.3 series lack the storage version check
logic I will unconditionally trigger the v1 → v2 on-disk upgrade for
Bookworm LTS, but need to wait for subsequent suites to add support for
the v2 format to avoid broken upgrade paths.)

Unfortunately dovecot doesn't allow overriding `dovecot_*_version` later
in `/etc/dovecot/conf.d/99-*.conf`.  Please consider bumping *both*
`dovecot_config_version` and `dovecot_storage_version` to 2.4.5.

An argument for bumping the former too is to honor the current
`mail_attachment_detection_options` default value for maildir.  With the
current value dovecot adds `$HasAttachment` or `$HasNoAttachment
keywords for maildir too, but doesn't bump the HIGHESTMODSEQ counter
resulting in split-brain issues for QRESYNC-capable synchronization
tools (possibly a dovecot bug, but the stock configuration is not
affected and given `dovecot_storage_version` needs to be bumped anyway
it probably makes sense to upgrade `dovecot_config_version` too).

Thanks for maintaining dovecot!

I think we'll want to do the unconditional format upgrade in the trixie
security update as well.  We don't want to bump supported_versions
without actually bumping to a new upstream dovecot release, which is
impractical.

For forky, we should update both settings as requested.

noah

We believe that the bug you reported is fixed in the latest version of
dovecot, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148937@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Noah Meyerhans <noahm@debian.org> (supplier of updated dovecot package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 26 Sep 2026 15:49:52 -0400
Source: dovecot
Architecture: source
Version: 1:2.4.5+dfsg1-3
Distribution: unstable
Urgency: medium
Maintainer: Dovecot Maintainers <dovecot@packages.debian.org>
Changed-By: Noah Meyerhans <noahm@debian.org>
Closes: 1148937
Changes:
 dovecot (1:2.4.5+dfsg1-3) unstable; urgency=medium
 .
   * [ae76ae5] update default dovecot_config_version and dovecot_storage_version
     (Closes: #1148937)
   * autopkgtests: fix mariadb socket path
Checksums-Sha1:
 9f96c6d3279f352a62d33249cc49a1d17ad12bb2 4184 dovecot_2.4.5+dfsg1-3.dsc
 0b98350be1b086dfd78feed15f069d35a50c65bd 91524 dovecot_2.4.5+dfsg1-3.debian.tar.xz
 0a4ee4c5282641f347ece378228b2e59753c4beb 8318 dovecot_2.4.5+dfsg1-3_source.buildinfo
Checksums-Sha256:
 e1b88e66f1bc30cc46b97159b4ba5b430d0de1136960f76d7af52de939e42c4b 4184 dovecot_2.4.5+dfsg1-3.dsc
 703db3862bb61750d16a64b825390e7177828883fb1aabd5351cbe0efa516dff 91524 dovecot_2.4.5+dfsg1-3.debian.tar.xz
 91ff86085655b0f13cde515c95b55dc28ea13105a9b9792eaa55d6ae291cd0e4 8318 dovecot_2.4.5+dfsg1-3_source.buildinfo
Files:
 bc4d6cfa7c67928d828498a4619bc7d0 4184 mail optional dovecot_2.4.5+dfsg1-3.dsc
 8944921a8b332c8eaf4ff1ccb6f3e13d 91524 mail optional dovecot_2.4.5+dfsg1-3.debian.tar.xz
 0a0cd69b442dfb1784321f246dabc45c 8318 mail optional dovecot_2.4.5+dfsg1-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE5G+E0xEKhJuZ7RJ34+c1IpshdTUFAmq4fToACgkQ4+c1Ipsh
dTUrOA/8CQEDVvF12/DWBmt7w8aMLVRZu5zne9FSNxUQXif5lYHg5Q6XbdCAmJCE
sF7EHUrEFzTiylSY+ORq61qGDLxvw/JIDCuBRhjqnnf4OTSUKYUvurJSjfweui6l
gDPRfFEI1XM8fkJ9THbW66MieI3ntP02JQHvYN//x6qFu/nCT+Y/4BUsZTQQZprq
SxQINV65zWH3fqOT0PmSECwf8FTeXpwqapyo1dF7r4huBlM3JcHVvAeicpaGvXAT
HeONDlj37krQ9Ijrq+IF6Au++QngWhu7GDIaXGhj3q9+Nd8CTB2vXGOulEn6lEil
bgblIeh7RF4roiTwRo7fj07iY7HA0lA3+ho1Ln9eb8/rDJVcDjehgjd84DS9A8xr
V+LvcEnHHdYEEdgJEJ2AOP2dTUvvuYbbCkmNo7qJoFzc9M054Lt/IMeV/9PrjrnJ
ykE/2lrSKwxnXzUXU4hXh0PXT6ZV5B4y+JQQJ2CD/oGrg4t/VxaBPRsgc9BXdbiP
4soF6cE5Y/24zUMt0Xz9XCy+weZWMT7HpERTPF4p2QjwkjX8ZBapNA+86HWcaSKT
zqViMW3Ex51TMZ/MmOYTVDolTuAHjoIFFeSRKJDfmp0SyNpTmIfPUjcS07+S+6GM
cQKtcSHdZS3wv+8qxaO+OfZ/RGq40rK4bDrZ7sBMDi6qhMsW9to=
=UXkG
-----END PGP SIGNATURE-----