Serious openssl bug crashes imaps sessions

[Eric Donkersloot]

There is a serious bug in the cyrus-imapd 2.5.10 series(https://github.com/cyrusimap/cyrus-imapd/issues/1872) which fortunately is fixed in the 2.5.11 release (https://cyrusimap.org/imap/download/release-notes/2.5/x/2.5.11.html).

Can you please update the cyrus-imapd packages to the 2.5.11 series?

[Eric Donkersloot (ericd)]

This bug is really annoying, especially if you have lot's of MacOS / iPhone / iPad clients connecting to your server.

[Ben Polman (ben-polman)]

This is also a real problem for outlook clients, leading to frequent disconnected sessions.
See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863520
for a very small patch to the 2.5.10-3ubuntu version.
I have applied this patch on our mailserver running on ubuntu 18.04 and
it fixes the issue

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Eric Donkersloot (ericd)]

Will the patched version ever land in Ubuntu 18.04? If not, I'll patch the server myself.
I'm a bit surprised (and disappointed - seeing the seriousness of this bug and the wide range of devices it affects) that the package hasn't been updated yet.

[Malte Langermann (mlangermann)]

still waiting for an update...
Is there an easy way to get a newer version for Ubuntu 18.04?

[Malte Langermann (mlangermann)]

a temporary solution is to set
tls_session_timeout: 0
in /etc/imapd.conf to disable tls session caching.

[Boris Dušek (dusek)]

mlangermann: are there please any drawbacks to the temporary solution you kindly offered (i.e. why did you call it temporary)?

[Boris Dušek (dusek)]

Please any chance of getting this fixed in the 18.04 LTS (Bionic)? It seems the package is hardly usable without this fixed.

[jasonmaier (joerg-maier)]

Hi,

Getting the same error in bionic. As this is the latest LTS ubuntu release and no update was done in more recent releases anyway, I patched cyrus-imapd according to the debian docs in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863520.

+1 for updating to 2.5.11 or adding the patch that fixes the issue.