CVS commit: pkgsrc/mail/postfix

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Tue Sep  8 14:17:30 UTC 2026

Modified Files:
        pkgsrc/mail/postfix: Makefile.common distinfo

Log Message:
mail/postfix: update to 3.11.7

3.11.7 (2026-09-08)

This release addresses medium-impact problems that need to be fixed
as some enable remote DOS or SMTP smugggling.

SMTP smuggling:

  * Bug (introduced: Postfix 3.9, date: 20240106) SMTP smuggling
    was still possible with smtpd_proxy_filter (disabled by default)
    when the after-filter SMTP server used the default policy
    settings "smtpd_forbid_bare_newline_exclusions = $mynetworks"
    and "smtpd_forbid_bare_newline = normalize". Reported by OpenAI
    Security. Fix by Wietse.

    As suggested by OpenAI Security, eliminate stray CR characters
    from the smtpd_proxy_filter input stream. The before-proxy-filter
    SMTP server already eliminated stray LF.

  * Bug (introduced: Postfix 3.11, date: 20250917): SMTP smuggling
    was possible with smtpd_proxy_filter (disabled by default) when
    the before-filter SMTP server added a "Require-TLS-ESMTP: yes"
    message header, due to implementation edge cases. Adding this
    header is enabled with the "requiretls_esmtp_header = yes"
    default setting. Reported by OpenAI Security. Fix by Wietse.

Server crashes and panic()s:

  * Bug (defect introduced: Postfix 3.0, date: 20140707): null
    pointer read error after receiving MAIL FROM, RCPT TO, and VRFY
    with an UTF8 address but no SMTPUTF8 parameter. This requires
    "smtputf8_enable = yes" (the default) and "strict_smtputf8 =
    yes" (not default). With this, the SMTP server did an unnecessary
    MAIL FROM reset without RCPT TO reset. A crafted remote SMTP
    client could then send a DATA command and crash a Postfix SMTP
    server process with a null pointer read error. Reported by
    Wonyoung Jung (78ResearchLab AI).

Other bugs

  * Bug (defect introduced: Postfix 3.4, date: 20180303): the MySQL
    client setting "tls_verify_cert = yes" had no effect with Oracle
    MySQL 8 and later. Report and fix by OpenAI Security.

  * Bug (defect introduced: Postfix-beta, date: 19990119): the
    pipe(8) delivery agent deleted a command-line argument if the
    argument contained $user AND $user expanded to an empty string,
    breaking the positional order of arguments. This was a workaround
    for a problem that hopefully no longer exists. Reported by
    Qualys, assisted by Claude Mythos Preview.

  * Bug (defect introduced: Postfix 2.3, date: 20050323): the SMTP
    client enhanced status code parser could process stale data
    when a remote SMTP server sent a three-digit reply without other
    text. Reported by Qualys, assisted by Claude Mythos Preview.

TLS

  * Isolation: stamp Postfix SMTP server TLS session tickets with
    their master.cf service name. With this, an SMTP server defined
    in master.cf will no longer accept tickets issued by a different
    SMTP server defined in the same master.cf file. Fix by OpenAI
    security.

Configuration safety

  * The postmap and postalias commands now log a warning when
    creating a root-owned database file in a directory that is not
    owned by root. They log that the database source file, indexed
    file(s), and parent directory should have the same owner, to
    prevent a privilege-escalation attack. Problem reported by
    OpenAI Security, remediation strategy (don't break production
    deployment) by Wietse.

Read after free, memory over-read

  * Bug (introduced: Postfix 2.3, date: 20060629): a malicious
    Milter or attacker-in-the-middle could trigger a null-terminated
    heap memory overread in the SMTP daemon while formatting a
    malformed multiline response. Fix from OpenAI Security adopted
    with minor changes.

  * Bug (defect introduced: Postfix 3.0, date: 20141117): in the
     postqueue command don't free() text before logging a fatal error
    message. Reported by Qualys, assisted by Claude Mythos Preview.

  * Code hygiene: in the SMTP client protocol engine, evaluate a
    RETURN() macro argument before freeing resources. Reported by
    Qualys, assisted by Claude Mythos Preview.

Code hardening (defense in depth, prevention)

  * (Postfix 3.11) Hardening: in the non-BerkeleyDB migration
    service, delay the decision between running postmap or postalias
    until after the database file/directory owner/permission checks.
    The benefit from making the decision early (better error messages)
    was not worth the risk. Qualys, assisted by Claude Mythos
    Preview.

  * (Postfix-3.11) Hardened the database parent directory permission
    checks for automatic re-indexing with the non-Berkeley-DB
    migration service.

  * Hardening command-line email submission: the postdrop command
    now disallows null and line-break characters in queue file
    envelope records (line-break characters in non-envelope queue
    file records are already neutralized by default with
    "cleanup_replace_stray_cr_lf = yes").

    The new constraint not only eliminates line-break injection
    into local mailbox files as reported by OpenAI Security, but
    also prevents other forms of misuse. Later, this constraint may
    be moved into the Postfix core. Fix by Wietse.

  * Shut up nagging from multiple AIs and harden the virtual delivery
    agent against an evil (LDAP or SQL) database.

  * Code hygiene: myrealloc(ptr, 0) still resulted in a panic.
    Reported by Qualys, assisted by Claude Mythos Preview. Also
    adopt a mystrndup() fix from Postfix 3.12.

Other:

  * Portability: OpenBSD does not define NS_INT16SZ. Brad Smith.


To generate a diff of this commit:
cvs rdiff -u -r1.68 -r1.69 pkgsrc/mail/postfix/Makefile.common
cvs rdiff -u -r1.227 -r1.228 pkgsrc/mail/postfix/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/mail/postfix/Makefile.common
diff -u pkgsrc/mail/postfix/Makefile.common:1.68 pkgsrc/mail/postfix/Makefile.common:1.69
--- pkgsrc/mail/postfix/Makefile.common:1.68    Tue Aug 11 15:15:50 2026
+++ pkgsrc/mail/postfix/Makefile.common Tue Sep  8 14:17:30 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile.common,v 1.68 2026/08/11 15:15:50 taca Exp $
+# $NetBSD: Makefile.common,v 1.69 2026/09/08 14:17:30 taca Exp $
 # used by mail/postfix/Makefile
 # used by mail/postfix/Makefile.module
 
-DISTNAME=      postfix-3.11.6
+DISTNAME=      postfix-3.11.7
 CATEGORIES=    mail
 MASTER_SITES=  https://ftp.fu-berlin.de/unix/mail/postfix/official/
 MASTER_SITES+= https://ghostarchive.org/postfix/postfix-release/official/

Index: pkgsrc/mail/postfix/distinfo
diff -u pkgsrc/mail/postfix/distinfo:1.227 pkgsrc/mail/postfix/distinfo:1.228
--- pkgsrc/mail/postfix/distinfo:1.227  Tue Aug 11 15:15:50 2026
+++ pkgsrc/mail/postfix/distinfo        Tue Sep  8 14:17:30 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.227 2026/08/11 15:15:50 taca Exp $
+$NetBSD: distinfo,v 1.228 2026/09/08 14:17:30 taca Exp $
 
-BLAKE2s (postfix-3.11.6.tar.gz) = ef919017c9f7132b86e05f2c1bc79f2060c29c197aee4a687609c80086616caa
-SHA512 (postfix-3.11.6.tar.gz) = eddb71b7b64a8f9e0fca8a93679e86ac53eebc458a09910e5f3a871523d35361071a391cc904e511835137d4461a6a779c1b24c519e2f6a7de577e55e71a75ba
-Size (postfix-3.11.6.tar.gz) = 5289392 bytes
+BLAKE2s (postfix-3.11.7.tar.gz) = e0f71d98a31638608018c933448ffcc9c5aebcc9d7ff61d577cb40b98863ce5e
+SHA512 (postfix-3.11.7.tar.gz) = 3b4ef7562a24bbab1d0ca361ac0af1037aa3d4ae65a7c825711de9d5d3ed88975aad63cb09991717de334f4382c29039b527a3e8d4e65c5a6d35efd3e782910f
+Size (postfix-3.11.7.tar.gz) = 5293599 bytes
 SHA1 (patch-aa) = c8216f133e202a7bb37682b0dbc1448f021e7c1c
 SHA1 (patch-ag) = 5b6f0e82ce8202d76043130392c4c76737b155d7
 SHA1 (patch-ai) = 765faa3f959ab0669055d3742a2a2cfc3b454235