fetchmail-6.6.5

[Bruce Dubbs]

New point version.

[Douglas R. Reno]

Accepted per Bruce's recommendation

[Douglas R. Reno]

I'm going to reassign these to the book for now so whoever wants to do them can do them.

In the meantime I will continue working on rivendell, but I do not want to continue holding the project back on important issues.

[Douglas R. Reno]

6.6.4

-------------------------------------------------------------------------------
fetchmail-6.6.4 (released 2026-05-08, 32432 LoC):

## BUGFIX
* The IMAP client will now properly quote the folder name given with the
  moveto rcfile option, or --moveto command-line option.
  Report and bugfix contributed by Corben Dallas.

## BUILD IMPROVEMENTS
* meson-based builds with wolfSSL should now also work when meson finds
  the wolfssl package through cmake, instead of pkgconfig. This is unsupported
  and depends on internal set(_wolfssl_includedir "...") in wolfSSL's
  lib/cmake/*.cmake files, and works as of wolfSSL 5.9.1.
  The supported way to build fetchmail with wolfSSL with meson is
  to make sure that wolfSSL is found with pkgconfig, as in (change /path/to!)
  meson setup --pkg-config-path /path/to/wolfssl/lib/pkgconfig

## EXPERIMENTAL CHANGES - these are not documented anywhere else, only here:
* fetchmail supports AWS-LC 1.71 or newer, since its relicensing to
  the Apache license v2.0.  Note this requires you to distribute fetchmail
  under terms of the GPLv3 because the GPLv2 is claimed incompatible
  with Apache license (this is no different for OpenSSL 3 or newer,
  or the one wolfSSL version that was GPLv3 licensed).
* fetchmail supports a FETCHMAIL_SSL_SECLEVEL environment variable
  (since 6.5.0, except when using AWS-LC where it is silently ignored),
  which can be used to override the OpenSSL security level.
  Fetchmail by default raises the security level to 2 if lower.
  This variable can be used to lower it.
  Use with extreme caution. Note that levels 3 or higher will frequently cause
  incompabilities with servers because server-side data sizes are often too low.
  Valid range: 0 to 5 for OpenSSL 1.1.1 and 3.0.
* fetchmail supports a FETCHMAIL_SSL_CIPHERS environment variable
  (since 6.5.0) that sets the cipher string (through two different OpenSSL
  functions) for SSL and TLS versions up to TLSv1.2.
  If setting the ciphers fails, fetchmail will not connect.
  If not given, defaults to "HIGH:MEDIUM:+RC4:@STRENGTH:!aNULL" - note
  that +RC4 is supposed to move the RC4 to the end of the list, not add it.
* fetchmail supports a FETCHMAIL_TLS13_CIPHERSUITES environment variable
  (since 6.5.0) that sets the ciphersuites (a colon-separated list,
  without + ! -) for TLSv1.3. If not given, defaults to the SSL library's
  built-in list. If setting the ciphersuites fails, fetchmail refuses to
  connect.
* NOTE the features above are simplistic. For instance, even though you
  configure --sslproto tls1.3, a failure to set tls1.2 ciphers could cause
  a connection abort.

6.6.5

fetchmail-6.6.5 (released 2026-06-17, 32433 LoC):

## SECURITY BUGFIX
* POP3 with RPA: fix calculation of buffer sizes to avoid buffer overflow
  on long service challenges with long user IDs, which would smash our stack.
    Triggering this requires that 1. RPA is enabled at compile time
  (non-default, which is discouraged in autotools, and possible but not
  documented nor supported in meson), and the username (--user option, or user
  in the rcfile) contains @compuserve.com anywhere, and the server supports an
  AUTH command without arguments (which is a non-standard local extension), and
  that it offers RPA authentication in response to that command.

  This was reported based on an incomplete semi-wrong AI report with an
  incomplete fix "recommendation" by zhangph12138@outlook.com via
  fetchmail-devel@.  The fix suggested in that AI report was wrong, and
  would happily crash a few lines later again.  The fix deployed calculates
  the buffer size of "workarea" variables based on the sizeof() of constituent
  components.

## BUGFIX
* Robustness: If RPA is enabled at compile time and POP3 is in use,
  do not barf if @compuserve.com is in the remote site's username (what you'd
  pass as --user, or user in the rcfile) and the remote site either does not
  support an "AUTH" command without parameters (normally, one is required, but
  some servers such as jpop and Cyrus allow AUTH to request the list of
  supported authentication types as an extension; the standard way would be
  a "CAPA" request instead), but try other authentication methods.
  Found by code auditing in response to a bug report against rpa.c.
  Note that enabling RPA is discouraged because it is based on the weak
  MD5 crypto algorithm.

[Douglas R. Reno]

Fixed at 5c4782370a25f55316897e87d5c059f9645d5357

Reassigning to SecurityAdvisory for a security advisory to be filed.

[Douglas R. Reno]

SA-13.0-130 issued