CVS commit: pkgsrc/mail/postfix

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Tue Aug 11 15:15:50 UTC 2026

Modified Files:
        pkgsrc/mail/postfix: Makefile.common distinfo

Log Message:
mail/postfix: update to 3.11.6

This release addresses medium-impact problems that need to be fixed
as some enable remote DOS or policy bypass.

These defects were found by Qualys assisted by Claude Mythos Preview,
and by OpenAI Security; more than half date from 20 or more years
ago. When I implemented Postfix, I knew that there were going to
be mistakes. That is the reason why Postfix has its architecture
and safety nets. The number of defects may seem large, but considering
that they were found in a code base of over 150 thousand lines, the
error rate is still lower than what I designed for.

Policy bypass:

  * Bug (introduced: Postfix 2.2, date: 20041102): missing SMTP
    server resets of MAIL FROM and RCPT TO command state after
    smtpd_end_of_data_restrictions rejected a message. This resulted
    in SMTP protocol state desynchronization between the remote
    SMTP client and the Postfix SMTP server.

    A crafted remote SMTP client could then send RCPT TO and DATA
    without MAIL FROM, and deliver a second message. Then,
    smtpd_end_of_data_restrictions skipped check_recipient_access
    constraints, because a recipient counter was > 1. Reported by
    OpenAI Security. File: smtpd/smtpd.c.

    As reported by OpenAI Security, the failure to reset MAIL FROM
    and RCPT TO state also affected Milter support (added in Postfix
    2.3). Here, after a Milter replied with "accept this message"
    based on the message envelope, and smtpd_end_of_data_restrictions
    rejected the message, the Postfix SMTP server as before accepted
    RCPT TO and DATA without MAIL FROM, and smtpd_end_of_data_restrictions
    as before skipped check_recipient_access constraints for the
    second message. Under these conditions, the Postfix Milter
    client remained in the "accept this message" state, skipping
    Milter policy enforcement for the second message.

Denial of service:

  * Bug (defect introduced: Postfix 3.4, date: 20180805): SMTP
    server command history memory exhaustion with a large number
    of very small BDAT requests. Reported by OpenAI security. File:
    smtpd.c.

  * Bug (defect introduced: Postfix 1.1, date: 20021116): address
    verification cache poisoning. A local user could use the postdrop
    command to submit an address verification probe with envelope
    or message content that Postfix rejected later, resulting in a
    negative address verification cache entry for that address. On
    systems that enable address verification, the negative address
    verification cache entry would force the Postfix SMTP server
    to reject a message that it should accept (denial of service).
    Problem reported by OpenAI Security. File: postdrop.c.

Server crashes and panic()s:

  * Bug (defect introduced: Postfix 3.4, date: 20180805): missing
    SMTP server reset of RCPT TO state, after a BDAT command error.
    A crafted remote SMTP client could then send a DATA command
    without MAIL FROM or RCPT TO, and crash a Postfix SMTP daemon
    process with a null pointer read error. Reported by OpenAI
    Security. File: smtpd/smtpd.c.

  * Bug (defect introduced: Postfix 2.4, date: 20051222): null
    pointer read crash while parsing a malformed Dovecot AUTH server
    response. Reported by Qualys, assisted by Claude Mythos Preview.
    File: xsasl_dovecot_server.c.

Read after free, uninitialized read, under/over read:

  * Bug (defect introduced: Postfix 2.8, date: 20100914): read-after-free
    in the PSC_CALL_BACK_NOTIFY() macro. This had no effect on
    program execution, because myfree() wiped memory, and that
    memory was not yet reused. Problem reported by Qualys, assisted
    by Claude Mythos Preview. File: postscreen_dnsbl.c.

  * Read after free (no privilege escalation) in debug logging
    (defect introduced: Postfix 2.2, date: 20050117). Reported by
    Qualys, assisted by Claude Mythos Preview. File: util/inet_connect.c.

  * Bug (defect introduced: Postfix 2.10, date: 20120617): uninitialized
    memory read in postscreen HaProxy client after remote I/O
    exception, causing garbage to be logged. Reported by Qualys,
    assisted by Claude Mythos Preview. File: postscreen_haproxy.c.

  * Latent bug (defect introduced: Postfix 2.7, date: 20090618):
    uninitialized memory read after dnsblog(8) returns a string
    that is not an IPv4 address. Reported by Qualys, assisted by
    Claude Mythos Preview. File: postscreen_dnsbl.c.

  * Bug (defect introduced: before Postfix alpha, date 19970424):
    the DNS client could read up to two bytes past the end of an
    MX record, before discovering that the record was too short.
    This behavior was later copied with SRV records, potentially
    over-reading up to six bytes. Problem reported by Qualys,
    assisted by Claude Mythos Preview. File: dns_lookup.c.

  * Bug (defect introduced: Postfix 1,1, date: 20010524): the
    postsuper command under-read or over-read a very short queue
    filename. No crash, information leak, or privilege escalation.
    Reported by Qualys, assisted by Claude Mythos Preview. Files:
    postsuper.c, mail_queue.h.

Other code hygiene:

  * Bug (defect introduced: before Postfix alpha, date: 19971106):
    'int' over-shift, in the queue file record-length parser. Postfix
    programs do not generate such records, but an attacker could
    cause postdrop to reject input or panic(). Reported by Qualys,
    assisted by Claude Mythos Preview. File: record.c.

  * Bug (defect introduced: Postfix 2.2, date: 20050117): non-transitive
    comparison of IPv4 addresses. Reported by Qualys, assisted by
    Claude Mythos Preview. File: sock_addr.c.

  * Bug (defect introduced: Postfix 1.0, date: 20000928): the fast
    flush server, used by the SMTP command "ETRN", and by the
    commands "postqueue -s site" and "postqueue -i queue_id" (and
    their sendmail(1) equivalents), used the wrong duplicate
    suppression API, resulting in unnecessary queue scans by the
    queue manager. Reported by Qualys, assisted by Claude Mythos
    Preview. File: flush.c.

  * Queue hygiene: the postdrop command accepted the null record
    type which the rest of Postfix ignores. Reported by OpenAI
    Security. File: postdrop.c.


To generate a diff of this commit:
cvs rdiff -u -r1.67 -r1.68 pkgsrc/mail/postfix/Makefile.common
cvs rdiff -u -r1.226 -r1.227 pkgsrc/mail/postfix/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/mail/postfix/Makefile.common
diff -u pkgsrc/mail/postfix/Makefile.common:1.67 pkgsrc/mail/postfix/Makefile.common:1.68
--- pkgsrc/mail/postfix/Makefile.common:1.67    Tue Jul  7 13:48:07 2026
+++ pkgsrc/mail/postfix/Makefile.common Tue Aug 11 15:15:50 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile.common,v 1.67 2026/07/07 13:48:07 taca Exp $
+# $NetBSD: Makefile.common,v 1.68 2026/08/11 15:15:50 taca Exp $
 # used by mail/postfix/Makefile
 # used by mail/postfix/Makefile.module
 
-DISTNAME=      postfix-3.11.5
+DISTNAME=      postfix-3.11.6
 CATEGORIES=    mail
 MASTER_SITES=  https://ftp.fu-berlin.de/unix/mail/postfix/official/
 MASTER_SITES+= https://ghostarchive.org/postfix/postfix-release/official/

Index: pkgsrc/mail/postfix/distinfo
diff -u pkgsrc/mail/postfix/distinfo:1.226 pkgsrc/mail/postfix/distinfo:1.227
--- pkgsrc/mail/postfix/distinfo:1.226  Tue Jul  7 13:48:07 2026
+++ pkgsrc/mail/postfix/distinfo        Tue Aug 11 15:15:50 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.226 2026/07/07 13:48:07 taca Exp $
+$NetBSD: distinfo,v 1.227 2026/08/11 15:15:50 taca Exp $
 
-BLAKE2s (postfix-3.11.5.tar.gz) = dbe5d6943b1c8635445fca40793759f068b01135e18896977b0d15f9f58bbaf0
-SHA512 (postfix-3.11.5.tar.gz) = af9d3678844afcbdf77c228e29138255a935c63988c3b8dff31bb2a66315f376d94d782b5545829e1491c6a1335172ad194b7f8fd02038db35cd6527cff82087
-Size (postfix-3.11.5.tar.gz) = 5287872 bytes
+BLAKE2s (postfix-3.11.6.tar.gz) = ef919017c9f7132b86e05f2c1bc79f2060c29c197aee4a687609c80086616caa
+SHA512 (postfix-3.11.6.tar.gz) = eddb71b7b64a8f9e0fca8a93679e86ac53eebc458a09910e5f3a871523d35361071a391cc904e511835137d4461a6a779c1b24c519e2f6a7de577e55e71a75ba
+Size (postfix-3.11.6.tar.gz) = 5289392 bytes
 SHA1 (patch-aa) = c8216f133e202a7bb37682b0dbc1448f021e7c1c
 SHA1 (patch-ag) = 5b6f0e82ce8202d76043130392c4c76737b155d7
 SHA1 (patch-ai) = 765faa3f959ab0669055d3742a2a2cfc3b454235