CVS commit: [pkgsrc-2026Q2] pkgsrc/mail/postfix

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Sun Aug 16 21:05:48 UTC 2026

Modified Files:
        pkgsrc/mail/postfix [pkgsrc-2026Q2]: Makefile.common distinfo

Log Message:
Pullup ticket #7228 - requested by taca
mail/postfix: Security fix

Revisions pulled up:
- mail/postfix/Makefile.common                                  1.68
- mail/postfix/distinfo                                         1.227

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Tue Aug 11 15:15:50 UTC 2026

   Modified Files:
        pkgsrc/mail/postfix: Makefile.common distinfo

   Log Message:
   mail/postfix: update to 3.11.6

   This release addresses medium-impact problems that need to be fixed
   as some enable remote DOS or policy bypass.

   These defects were found by Qualys assisted by Claude Mythos Preview,
   and by OpenAI Security; more than half date from 20 or more years
   ago. When I implemented Postfix, I knew that there were going to
   be mistakes. That is the reason why Postfix has its architecture
   and safety nets. The number of defects may seem large, but considering
   that they were found in a code base of over 150 thousand lines, the
   error rate is still lower than what I designed for.

   Policy bypass:

     * Bug (introduced: Postfix 2.2, date: 20041102): missing SMTP
       server resets of MAIL FROM and RCPT TO command state after
       smtpd_end_of_data_restrictions rejected a message. This resulted
       in SMTP protocol state desynchronization between the remote
       SMTP client and the Postfix SMTP server.

       A crafted remote SMTP client could then send RCPT TO and DATA
       without MAIL FROM, and deliver a second message. Then,
       smtpd_end_of_data_restrictions skipped check_recipient_access
       constraints, because a recipient counter was > 1. Reported by
       OpenAI Security. File: smtpd/smtpd.c.

       As reported by OpenAI Security, the failure to reset MAIL FROM
       and RCPT TO state also affected Milter support (added in Postfix
       2.3). Here, after a Milter replied with "accept this message"
       based on the message envelope, and smtpd_end_of_data_restrictions
       rejected the message, the Postfix SMTP server as before accepted
       RCPT TO and DATA without MAIL FROM, and smtpd_end_of_data_restrictions
       as before skipped check_recipient_access constraints for the
       second message. Under these conditions, the Postfix Milter
       client remained in the "accept this message" state, skipping
       Milter policy enforcement for the second message.

   Denial of service:

     * Bug (defect introduced: Postfix 3.4, date: 20180805): SMTP
       server command history memory exhaustion with a large number
       of very small BDAT requests. Reported by OpenAI security. File:
       smtpd.c.

     * Bug (defect introduced: Postfix 1.1, date: 20021116): address
       verification cache poisoning. A local user could use the postdrop
       command to submit an address verification probe with envelope
       or message content that Postfix rejected later, resulting in a
       negative address verification cache entry for that address. On
       systems that enable address verification, the negative address
       verification cache entry would force the Postfix SMTP server
       to reject a message that it should accept (denial of service).
       Problem reported by OpenAI Security. File: postdrop.c.

   Server crashes and panic()s:

     * Bug (defect introduced: Postfix 3.4, date: 20180805): missing
       SMTP server reset of RCPT TO state, after a BDAT command error.
       A crafted remote SMTP client could then send a DATA command
       without MAIL FROM or RCPT TO, and crash a Postfix SMTP daemon
       process with a null pointer read error. Reported by OpenAI
       Security. File: smtpd/smtpd.c.

     * Bug (defect introduced: Postfix 2.4, date: 20051222): null
       pointer read crash while parsing a malformed Dovecot AUTH server
       response. Reported by Qualys, assisted by Claude Mythos Preview.
       File: xsasl_dovecot_server.c.

   Read after free, uninitialized read, under/over read:

     * Bug (defect introduced: Postfix 2.8, date: 20100914): read-after-free
       in the PSC_CALL_BACK_NOTIFY() macro. This had no effect on
       program execution, because myfree() wiped memory, and that
       memory was not yet reused. Problem reported by Qualys, assisted
       by Claude Mythos Preview. File: postscreen_dnsbl.c.

     * Read after free (no privilege escalation) in debug logging
       (defect introduced: Postfix 2.2, date: 20050117). Reported by
       Qualys, assisted by Claude Mythos Preview. File: util/inet_connect.c.

     * Bug (defect introduced: Postfix 2.10, date: 20120617): uninitialized
       memory read in postscreen HaProxy client after remote I/O
       exception, causing garbage to be logged. Reported by Qualys,
       assisted by Claude Mythos Preview. File: postscreen_haproxy.c.

     * Latent bug (defect introduced: Postfix 2.7, date: 20090618):
       uninitialized memory read after dnsblog(8) returns a string
       that is not an IPv4 address. Reported by Qualys, assisted by
       Claude Mythos Preview. File: postscreen_dnsbl.c.

     * Bug (defect introduced: before Postfix alpha, date 19970424):
       the DNS client could read up to two bytes past the end of an
       MX record, before discovering that the record was too short.
       This behavior was later copied with SRV records, potentially
       over-reading up to six bytes. Problem reported by Qualys,
       assisted by Claude Mythos Preview. File: dns_lookup.c.

     * Bug (defect introduced: Postfix 1,1, date: 20010524): the
       postsuper command under-read or over-read a very short queue
       filename. No crash, information leak, or privilege escalation.
       Reported by Qualys, assisted by Claude Mythos Preview. Files:
       postsuper.c, mail_queue.h.

   Other code hygiene:

     * Bug (defect introduced: before Postfix alpha, date: 19971106):
       'int' over-shift, in the queue file record-length parser. Postfix
       programs do not generate such records, but an attacker could
       cause postdrop to reject input or panic(). Reported by Qualys,
       assisted by Claude Mythos Preview. File: record.c.

     * Bug (defect introduced: Postfix 2.2, date: 20050117): non-transitive
       comparison of IPv4 addresses. Reported by Qualys, assisted by
       Claude Mythos Preview. File: sock_addr.c.

     * Bug (defect introduced: Postfix 1.0, date: 20000928): the fast
       flush server, used by the SMTP command "ETRN", and by the
       commands "postqueue -s site" and "postqueue -i queue_id" (and
       their sendmail(1) equivalents), used the wrong duplicate
       suppression API, resulting in unnecessary queue scans by the
       queue manager. Reported by Qualys, assisted by Claude Mythos
       Preview. File: flush.c.

     * Queue hygiene: the postdrop command accepted the null record
       type which the rest of Postfix ignores. Reported by OpenAI
       Security. File: postdrop.c.


To generate a diff of this commit:
cvs rdiff -u -r1.65.2.1 -r1.65.2.2 pkgsrc/mail/postfix/Makefile.common
cvs rdiff -u -r1.224.2.1 -r1.224.2.2 pkgsrc/mail/postfix/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/mail/postfix/Makefile.common
diff -u pkgsrc/mail/postfix/Makefile.common:1.65.2.1 pkgsrc/mail/postfix/Makefile.common:1.65.2.2
--- pkgsrc/mail/postfix/Makefile.common:1.65.2.1        Thu Jul 16 14:10:12 2026
+++ pkgsrc/mail/postfix/Makefile.common Sun Aug 16 21:05:48 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile.common,v 1.65.2.1 2026/07/16 14:10:12 maya Exp $
+# $NetBSD: Makefile.common,v 1.65.2.2 2026/08/16 21:05:48 maya Exp $
 # used by mail/postfix/Makefile
 # used by mail/postfix/Makefile.module
 
-DISTNAME=      postfix-3.11.5
+DISTNAME=      postfix-3.11.6
 CATEGORIES=    mail
 MASTER_SITES=  https://ftp.fu-berlin.de/unix/mail/postfix/official/
 MASTER_SITES+= https://ghostarchive.org/postfix/postfix-release/official/

Index: pkgsrc/mail/postfix/distinfo
diff -u pkgsrc/mail/postfix/distinfo:1.224.2.1 pkgsrc/mail/postfix/distinfo:1.224.2.2
--- pkgsrc/mail/postfix/distinfo:1.224.2.1      Thu Jul 16 14:10:12 2026
+++ pkgsrc/mail/postfix/distinfo        Sun Aug 16 21:05:48 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.224.2.1 2026/07/16 14:10:12 maya Exp $
+$NetBSD: distinfo,v 1.224.2.2 2026/08/16 21:05:48 maya Exp $
 
-BLAKE2s (postfix-3.11.5.tar.gz) = dbe5d6943b1c8635445fca40793759f068b01135e18896977b0d15f9f58bbaf0
-SHA512 (postfix-3.11.5.tar.gz) = af9d3678844afcbdf77c228e29138255a935c63988c3b8dff31bb2a66315f376d94d782b5545829e1491c6a1335172ad194b7f8fd02038db35cd6527cff82087
-Size (postfix-3.11.5.tar.gz) = 5287872 bytes
+BLAKE2s (postfix-3.11.6.tar.gz) = ef919017c9f7132b86e05f2c1bc79f2060c29c197aee4a687609c80086616caa
+SHA512 (postfix-3.11.6.tar.gz) = eddb71b7b64a8f9e0fca8a93679e86ac53eebc458a09910e5f3a871523d35361071a391cc904e511835137d4461a6a779c1b24c519e2f6a7de577e55e71a75ba
+Size (postfix-3.11.6.tar.gz) = 5289392 bytes
 SHA1 (patch-aa) = c8216f133e202a7bb37682b0dbc1448f021e7c1c
 SHA1 (patch-ag) = 5b6f0e82ce8202d76043130392c4c76737b155d7
 SHA1 (patch-ai) = 765faa3f959ab0669055d3742a2a2cfc3b454235