You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

289 lines
12 KiB

exim: update to version 4.94.2 Several exploitable vulnerabilities in Exim were reported to us and are fixed. Local vulnerabilities - CVE-2020-28007: Link attack in Exim's log directory - CVE-2020-28008: Assorted attacks in Exim's spool directory - CVE-2020-28014: Arbitrary PID file creation - CVE-2020-28011: Heap buffer overflow in queue_run() - CVE-2020-28010: Heap out-of-bounds write in main() - CVE-2020-28013: Heap buffer overflow in parse_fix_phrase() - CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase() - CVE-2020-28015: New-line injection into spool header file (local) - CVE-2020-28012: Missing close-on-exec flag for privileged pipe - CVE-2020-28009: Integer overflow in get_stdinput() Remote vulnerabilities - CVE-2020-28017: Integer overflow in receive_add_recipient() - CVE-2020-28020: Integer overflow in receive_msg() - CVE-2020-28023: Out-of-bounds read in smtp_setup_msg() - CVE-2020-28021: New-line injection into spool header file (remote) - CVE-2020-28022: Heap out-of-bounds read and write in extract_option() - CVE-2020-28026: Line truncation and injection in spool_read_header() - CVE-2020-28019: Failure to reset function pointer after BDAT error - CVE-2020-28024: Heap buffer underflow in smtp_ungetc() - CVE-2020-28018: Use-after-free in tls-openssl.c - CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash() The update to 4.94.2 also integrates a fix for a printf format issue previously addressed by a local patch which is removed. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
4 years ago
exim: update to version 4.94.2 Several exploitable vulnerabilities in Exim were reported to us and are fixed. Local vulnerabilities - CVE-2020-28007: Link attack in Exim's log directory - CVE-2020-28008: Assorted attacks in Exim's spool directory - CVE-2020-28014: Arbitrary PID file creation - CVE-2020-28011: Heap buffer overflow in queue_run() - CVE-2020-28010: Heap out-of-bounds write in main() - CVE-2020-28013: Heap buffer overflow in parse_fix_phrase() - CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase() - CVE-2020-28015: New-line injection into spool header file (local) - CVE-2020-28012: Missing close-on-exec flag for privileged pipe - CVE-2020-28009: Integer overflow in get_stdinput() Remote vulnerabilities - CVE-2020-28017: Integer overflow in receive_add_recipient() - CVE-2020-28020: Integer overflow in receive_msg() - CVE-2020-28023: Out-of-bounds read in smtp_setup_msg() - CVE-2020-28021: New-line injection into spool header file (remote) - CVE-2020-28022: Heap out-of-bounds read and write in extract_option() - CVE-2020-28026: Line truncation and injection in spool_read_header() - CVE-2020-28019: Failure to reset function pointer after BDAT error - CVE-2020-28024: Heap buffer underflow in smtp_ungetc() - CVE-2020-28018: Use-after-free in tls-openssl.c - CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash() The update to 4.94.2 also integrates a fix for a printf format issue previously addressed by a local patch which is removed. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
4 years ago
  1. include $(TOPDIR)/rules.mk
  2. PKG_NAME:=exim
  3. PKG_VERSION:=4.94.2
  4. PKG_RELEASE:=$(AUTORELEASE)
  5. PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
  6. PKG_SOURCE_URL:=https://ftp.exim.org/pub/exim/exim4/
  7. PKG_HASH:=051861fc89f06205162f12129fb7ebfe473383bb6194bf8642952bfd50329274
  8. PKG_MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
  9. PKG_LICENSE:=GPL-2.0-or-later
  10. PKG_LICENSE_FILES:=LICENSE NOTICE
  11. PKG_CPE_ID:=cpe:/a:exim:exim
  12. PKG_CONFIG_DEPENDS:=\
  13. CONFIG_BUILD_NLS \
  14. CONFIG_PACKAGE_exim \
  15. CONFIG_PACKAGE_exim-gnutls \
  16. CONFIG_EXIM_GNUTLS_DANE \
  17. CONFIG_PACKAGE_exim-openssl \
  18. CONFIG_PACKAGE_exim-ldap \
  19. CONFIG_PACKAGE_exim-lookup-mysql \
  20. CONFIG_PACKAGE_exim-lookup-pgsql \
  21. CONFIG_PACKAGE_exim-lookup-redis \
  22. CONFIG_PACKAGE_exim-lookup-sqlite
  23. PKG_BUILD_PARALLEL:=1
  24. include $(INCLUDE_DIR)/package.mk
  25. include $(INCLUDE_DIR)/host-build.mk
  26. include $(INCLUDE_DIR)/nls.mk
  27. LOOKUPS:= \
  28. cdb \
  29. dbmdb \
  30. dnsdb \
  31. json%+PACKAGE_exim-lookup-json:jansson \
  32. mysql%+PACKAGE_exim-lookup-mysql:libmariadb \
  33. passwd \
  34. pgsql%+PACKAGE_exim-lookup-pgsql:libpq \
  35. redis%+PACKAGE_exim-lookup-redis:libhiredis \
  36. sqlite%+PACKAGE_exim-lookup-sqlite:libsqlite3
  37. define Package/exim/Default
  38. SECTION:=mail
  39. CATEGORY:=Mail
  40. DEPENDS:=+libdb47 +libpcre $(ICONV_DEPENDS) +BUILD_NLS:libidn2 +BUILD_NLS:libidn
  41. TITLE:=Exim message transfer agent
  42. URL:=http://www.exim.org/
  43. USERID:=mail=42:mail=42
  44. endef
  45. define Package/exim
  46. $(call Package/exim/Default)
  47. VARIANT:=nossl
  48. CONFLICTS:=exim-openssl exim-gnutls exim-ldap
  49. endef
  50. define Package/exim-gnutls
  51. $(call Package/exim/Default)
  52. TITLE+=(with GnuTLS)
  53. VARIANT:=gnutls
  54. DEPENDS+=+PACKAGE_exim-gnutls:libgnutls +EXIM_GNUTLS_DANE:libgnutls-dane
  55. PROVIDES:=exim
  56. CONFLICTS:=exim-openssl exim-ldap
  57. endef
  58. define Package/exim-openssl
  59. $(call Package/exim/Default)
  60. TITLE+=(with OpenSSL)
  61. VARIANT:=openssl
  62. DEPENDS+=+PACKAGE_exim-openssl:libopenssl
  63. PROVIDES:=exim
  64. CONFLICTS:=exim-ldap
  65. endef
  66. define Package/exim-ldap
  67. $(call Package/exim/Default)
  68. TITLE+=(with OpenSSL and OpenLDAP)
  69. VARIANT:=ldap
  70. DEPENDS+=+PACKAGE_exim-ldap:libopenssl +PACKAGE_exim-ldap:libsasl2 +PACKAGE_exim-ldap:libopenldap
  71. PROVIDES:=exim
  72. endef
  73. define Package/exim/Default/description
  74. Exim is a message transfer agent (MTA) developed at the University of
  75. Cambridge for use on Unix systems connected to the Internet.
  76. endef
  77. define Package/exim/description
  78. $(call Package/exim/Default/description)
  79. This package provides Exim without TLS support.
  80. endef
  81. define Package/exim-gnutls/description
  82. $(call Package/exim/Default/description)
  83. This package provides Exim built with GnuTLS.
  84. endef
  85. define Package/exim-gnutls/config
  86. config EXIM_GNUTLS_DANE
  87. bool "exim-gnutls DANE support"
  88. depends on PACKAGE_exim-gnutls
  89. default n
  90. help
  91. Build exim-gnutls against libgnutls-dane for DANE support.
  92. libgnutls-dane depends on libunbound which depends on libopenssl.
  93. endef
  94. define Package/exim-openssl/description
  95. $(call Package/exim/Default/description)
  96. This package provides Exim built with OpenSSL.
  97. endef
  98. define Package/exim-ldap/description
  99. $(call Package/exim/Default/description)
  100. This package provides Exim built with OpenSSL, OpenLDAP and Cyrus SASL.
  101. endef
  102. define LookupGen
  103. define Package/exim-lookup-$(subst _,-,$(firstword $(subst %, ,$(1))))
  104. SECTION:=mail
  105. CATEGORY:=Mail
  106. TITLE:=Exim lookup module $(firstword $(subst %, ,$(1)))
  107. URL:=http://www.exim.org/
  108. DEPENDS:=exim $(wordlist 2,$(words $(subst %, ,$(1))),$(subst %, ,$(1)))
  109. endef
  110. endef
  111. $(foreach file,$(LOOKUPS),$(eval $(call LookupGen,$(file))))
  112. define Package/exim/conffiles
  113. /etc/exim/exim.conf
  114. endef
  115. HOST_CFLAGS += -std=c99
  116. TARGET_CFLAGS += $(FPIC) -DNO_IP_OPTIONS -D_FILE_OFFSET_BITS=64
  117. MAKE_VARS += build=Linux-$$(ARCH)
  118. MAKE_FLAGS += AR="$$(TARGET_AR) r"
  119. HOST_MAKE_VARS += build=Linux-$$(ARCH)
  120. define Build/Configure
  121. $(CP) $(PKG_BUILD_DIR)/src/EDITME $(PKG_BUILD_DIR)/Local/Makefile
  122. echo "PID_FILE_PATH=/var/run/exim.pid" >> $(PKG_BUILD_DIR)/Local/Makefile
  123. echo "BIN_DIRECTORY=/usr/sbin" >> $(PKG_BUILD_DIR)/Local/Makefile
  124. $(SED) 's%CONFIGURE_FILE=/usr/exim/configure%CONFIGURE_FILE=/etc/exim/exim.conf%' $(PKG_BUILD_DIR)/Local/Makefile
  125. $(SED) 's%# EXIM_GROUP=%EXIM_GROUP=42%' $(PKG_BUILD_DIR)/Local/Makefile
  126. $(SED) 's%# EXIM_USER=exim%EXIM_USER=42%' $(PKG_BUILD_DIR)/Local/Makefile
  127. $(SED) 's%# INCLUDE=.*%INCLUDE=-I$(STAGING_DIR)/usr/include -I$(STAGING_DIR)/usr/include%' $(PKG_BUILD_DIR)/Local/Makefile
  128. $(SED) 's%# HAVE_IPV6=YES%HAVE_IPV6=YES%' $(PKG_BUILD_DIR)/Local/Makefile
  129. $(SED) 's%# WITH_CONTENT_SCAN=yes%WITH_CONTENT_SCAN=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  130. $(SED) 's%# SUPPORT_MAILDIR=yes%SUPPORT_MAILDIR=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  131. $(SED) 's%# SUPPORT_MAILSTORE=yes%SUPPORT_MAILSTORE=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  132. $(SED) 's%# SUPPORT_MBX=yes%SUPPORT_MBX=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  133. # enable lookup modules
  134. $(SED) 's%# LOOKUP_DSEARCH=yes%LOOKUP_DSEARCH=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  135. ifdef CONFIG_PACKAGE_exim-lookup-dbmdb
  136. $(SED) 's%LOOKUP_DBM=yes%LOOKUP_DBM=2%' $(PKG_BUILD_DIR)/Local/Makefile
  137. else
  138. $(SED) 's%LOOKUP_DBM=yes%# LOOKUP_DBM=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  139. endif
  140. ifdef CONFIG_PACKAGE_exim-lookup-dnsdb
  141. $(SED) 's%LOOKUP_DNSDB=yes%LOOKUP_DNSDB=2%' $(PKG_BUILD_DIR)/Local/Makefile
  142. else
  143. $(SED) 's%LOOKUP_DNSDB=yes%# LOOKUP_DNSDB=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  144. endif
  145. ifdef CONFIG_PACKAGE_exim-lookup-passwd
  146. $(SED) 's%# LOOKUP_PASSWD=yes%LOOKUP_PASSWD=2%' $(PKG_BUILD_DIR)/Local/Makefile
  147. endif
  148. ifdef CONFIG_PACKAGE_exim-lookup-cdb
  149. $(SED) 's%# LOOKUP_CDB=yes%LOOKUP_CDB=2%' $(PKG_BUILD_DIR)/Local/Makefile
  150. endif
  151. ifdef CONFIG_PACKAGE_exim-lookup-json
  152. $(SED) 's%# LOOKUP_JSON=yes%LOOKUP_JSON=2\
  153. \nLOOKUP_JSON_INCLUDE=-I$(STAGING_DIR)/usr/include\
  154. \nLOOKUP_JSON_LIBS=-Wl,--no-as-needed -ljansson%' $(PKG_BUILD_DIR)/Local/Makefile
  155. endif
  156. ifdef CONFIG_PACKAGE_exim-lookup-pgsql
  157. $(SED) 's%# LOOKUP_PGSQL=yes%LOOKUP_PGSQL=2\
  158. \nLOOKUP_PGSQL_LIBS=-Wl,--no-as-needed -lpq%' $(PKG_BUILD_DIR)/Local/Makefile
  159. endif
  160. ifdef CONFIG_PACKAGE_exim-lookup-sqlite
  161. $(SED) 's%# LOOKUP_SQLITE=yes%LOOKUP_SQLITE=2\
  162. \nLOOKUP_SQLITE_LIBS=-Wl,--no-as-needed -lsqlite3%' $(PKG_BUILD_DIR)/Local/Makefile
  163. endif
  164. ifdef CONFIG_PACKAGE_exim-lookup-mysql
  165. $(SED) 's%# LOOKUP_MYSQL=yes%LOOKUP_MYSQL=2\
  166. \nLOOKUP_MYSQL_INCLUDE=-I$(STAGING_DIR)/usr/include/mysql\
  167. \nLOOKUP_MYSQL_LIBS=-Wl,--no-as-needed -lmysqlclient%' $(PKG_BUILD_DIR)/Local/Makefile
  168. endif
  169. ifdef CONFIG_PACKAGE_exim-lookup-redis
  170. $(SED) 's%# LOOKUP_REDIS=yes%LOOKUP_REDIS=2\
  171. \nLOOKUP_REDIS_INCLUDE=-I$(STAGING_DIR)/usr/include/hiredis\
  172. \nLOOKUP_REDIS_LIBS=-Wl,--no-as-needed -lhiredis%' $(PKG_BUILD_DIR)/Local/Makefile
  173. endif
  174. ifeq ($(CONFIG_BUILD_NLS),y)
  175. $(SED) 's%# HAVE_ICONV=yes%HAVE_ICONV=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  176. $(SED) 's%# CFLAGS=-O -I/usr/local/include%CFLAGS=$(TARGET_CFLAGS) $(ICONV_CPPFLAGS)%' $(PKG_BUILD_DIR)/Local/Makefile
  177. $(SED) 's%# EXTRALIBS_EXIM=-L/usr/local/lib -liconv%EXTRALIBS_EXIM=-export-dynamic -rdynamic $(ICONV_LDFLAGS) -liconv -ldl%' $(PKG_BUILD_DIR)/Local/Makefile
  178. $(SED) 's%# SUPPORT_I18N_2008=yes%SUPPORT_I18N_2008=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  179. $(SED) 's%# LDFLAGS += -lidn -lidn2%LDFLAGS += -lidn -lidn2%' $(PKG_BUILD_DIR)/Local/Makefile
  180. else
  181. $(SED) 's%# HAVE_ICONV=yes%HAVE_ICONV=no%' $(PKG_BUILD_DIR)/Local/Makefile
  182. endif
  183. $(SED) 's%# AUTH_CRAM_MD5=yes%AUTH_CRAM_MD5=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  184. $(SED) 's%# AUTH_DOVECOT=yes%AUTH_DOVECOT=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  185. $(SED) 's%# AUTH_EXTERNAL=yes%AUTH_EXTERNAL=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  186. $(SED) 's%# AUTH_PLAINTEXT=yes%AUTH_PLAINTEXT=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  187. $(SED) 's%# AUTH_SPA=yes%AUTH_SPA=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  188. ifeq ($(BUILD_VARIANT),gnutls)
  189. $(SED) 's%# USE_GNUTLS=yes%USE_GNUTLS=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  190. $(SED) 's%# TLS_INCLUDE=-I/usr/local/.*%TLS_INCLUDE=-I$(STAGING_DIR)/usr/include%' $(PKG_BUILD_DIR)/Local/Makefile
  191. ifeq ($(CONFIG_EXIM_GNUTLS_DANE),y)
  192. $(SED) 's%# TLS_LIBS=-lgnutls -lgnutls-dane%TLS_LIBS=-L$(STAGING_DIR)/usr/lib -lgnutls -lgnutls-dane%' $(PKG_BUILD_DIR)/Local/Makefile
  193. else
  194. $(SED) 's%SUPPORT_DANE=yes%# SUPPORT_DANE=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  195. $(SED) 's%# TLS_LIBS=-lgnutls -lgnutls-dane%TLS_LIBS=-L$(STAGING_DIR)/usr/lib -lgnutls%' $(PKG_BUILD_DIR)/Local/Makefile
  196. endif
  197. $(SED) 's%# AUTH_TLS=yes%AUTH_TLS=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  198. endif
  199. ifneq ($(filter ldap openssl, $(BUILD_VARIANT)),)
  200. $(SED) 's%# USE_OPENSSL=yes%USE_OPENSSL=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  201. $(SED) 's%# TLS_INCLUDE=-I/usr/local/.*%TLS_INCLUDE=-I$(STAGING_DIR)/usr/include%' $(PKG_BUILD_DIR)/Local/Makefile
  202. $(SED) 's%# TLS_LIBS=-lssl -lcrypto%TLS_LIBS=-L$(STAGING_DIR)/usr/lib -lssl -lcrypto%' $(PKG_BUILD_DIR)/Local/Makefile
  203. $(SED) 's%# AUTH_TLS=yes%AUTH_TLS=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  204. endif
  205. ifeq ($(BUILD_VARIANT),ldap)
  206. $(SED) 's%# LOOKUP_LDAP=yes%LOOKUP_LDAP=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  207. $(SED) 's%# LDAP_LIB_TYPE=OPENLDAP2%LDAP_LIB_TYPE=OPENLDAP2%' $(PKG_BUILD_DIR)/Local/Makefile
  208. echo "LOOKUP_LIBS+=-lldap -llber" >> $(PKG_BUILD_DIR)/Local/Makefile
  209. $(SED) 's%# AUTH_CYRUS_SASL=yes%AUTH_CYRUS_SASL=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  210. $(SED) 's%# AUTH_LIBS=-lsasl2%AUTH_LIBS=-lsasl2%' $(PKG_BUILD_DIR)/Local/Makefile
  211. endif
  212. ifeq ($(BUILD_VARIANT),nossl)
  213. $(SED) 's%# DISABLE_TLS=yes%DISABLE_TLS=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  214. $(SED) 's%SUPPORT_DANE=yes%# SUPPORT_DANE=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  215. endif
  216. $(SED) 's%# CFLAGS_DYNAMIC=-shared -rdynamic -fPIC%CFLAGS_DYNAMIC=-shared -rdynamic $(FPIC)%' $(PKG_BUILD_DIR)/Local/Makefile
  217. $(SED) 's%# LOOKUP_MODULE_DIR=/usr/lib/exim/lookups/%LOOKUP_MODULE_DIR=/usr/lib/exim/lookups/%' $(PKG_BUILD_DIR)/Local/Makefile
  218. $(SED) 's%#DLOPEN_LOCAL_SCAN=yes%DLOPEN_LOCAL_SCAN=yes%' $(PKG_BUILD_DIR)/Local/Makefile
  219. $(call Build/Compile/Default,makefile)
  220. $(CP) $(PKG_BUILD_DIR)/OS/os.h-Linux $(PKG_BUILD_DIR)/build-Linux-$(ARCH)/os.h
  221. # overwrite types for cross-compile
  222. # (is all the below true for glibc as well?)
  223. echo '#include <inttypes.h>' >> $(PKG_BUILD_DIR)/build-Linux-$(ARCH)/os.h
  224. echo '#define ip_options ip_opts' >> $(PKG_BUILD_DIR)/build-Linux-$(ARCH)/os.h
  225. echo '#undef OFF_T_FMT' >> $(PKG_BUILD_DIR)/build-Linux-$(ARCH)/os.h
  226. echo '#define OFF_T_FMT "%" PRId64' >> $(PKG_BUILD_DIR)/build-Linux-$(ARCH)/os.h
  227. echo '#undef LONGLONG_T' >> $(PKG_BUILD_DIR)/build-Linux-$(ARCH)/os.h
  228. echo '#define LONGLONG_T int64_t' >> $(PKG_BUILD_DIR)/build-Linux-$(ARCH)/os.h
  229. echo '#ifndef NS_MAXMSG' >> $(PKG_BUILD_DIR)/build-Linux-$(ARCH)/os.h
  230. echo '#define NS_MAXMSG 65535' >> $(PKG_BUILD_DIR)/build-Linux-$(ARCH)/os.h
  231. echo '#endif' >> $(PKG_BUILD_DIR)/build-Linux-$(ARCH)/os.h
  232. $(HOST_MAKE_VARS) $(MAKE) $(HOST_MAKE_FLAGS) $(HOST_MAKE_VARS) -C $(PKG_BUILD_DIR)/build-Linux-$(ARCH) macro_predef
  233. endef
  234. define Package/exim/install
  235. $(INSTALL_DIR) $(1)/usr/sbin
  236. $(INSTALL_BIN) $(PKG_BUILD_DIR)/build-Linux-$(ARCH)/exim $(1)/usr/sbin
  237. endef
  238. Package/exim-gnutls/install = $(Package/exim/install)
  239. Package/exim-openssl/install = $(Package/exim/install)
  240. Package/exim-ldap/install = $(Package/exim/install)
  241. define LookupInstall
  242. define Package/exim-lookup-$(subst _,-,$(firstword $(subst %, ,$(1))))/install
  243. $(INSTALL_DIR) $$(1)/usr/lib/exim/lookups
  244. $(INSTALL_BIN) \
  245. $(PKG_BUILD_DIR)/build-Linux-$(ARCH)/lookups/$(firstword $(subst %, ,$(1))).so \
  246. $$(1)/usr/lib/exim/lookups
  247. endef
  248. endef
  249. $(foreach file,$(LOOKUPS),$(eval $(call LookupInstall,$(file))))
  250. $(eval $(call BuildPackage,exim))
  251. $(eval $(call BuildPackage,exim-gnutls))
  252. $(eval $(call BuildPackage,exim-openssl))
  253. $(eval $(call BuildPackage,exim-ldap))
  254. $(foreach file,$(LOOKUPS),$(eval $(call BuildPackage,exim-lookup-$(subst _,-,$(firstword $(subst %, ,$(file)))))))