sieve-connect security update to 0.85

[Phil Pennock]

I'm the author of sieve-connect. Version 0.85 is a security update. More details in the announcement on the announcements mailing-list.

http://mail.globnix.net/pipermail/sieve-connect-announce/2013/000005.html

Sorry for the inconvenience.

Short version: failure to verify TLS certificate against the hostname (API confusion and stupidity on my part).

[Seth Arnold (seth-arnold)]

Since sieve-connect is in Universe, it is maintained by the community: anyone can prepare debdiffs for updating any of our releases.

We prefer updates to be minimal where possible -- which ought to be fine, since libio-socket-ssl-perl is version 1.31-1 in our oldest supported distribution, 10.04 LTS -- if you're able to prepare a minimal patch for our releases, that would be best. (It _is_ possible to get an exception for just taking full releases, see https://wiki.ubuntu.com/StableReleaseUpdates/MicroReleaseExceptions for details.)

Thanks

[Phil Pennock (phil.pennock)]

I don't use Debian or Ubuntu enough to be familiar with the tools, it'll be a wait for me to find time to figure the stuff out. I develop on FreeBSD.

I can try to figure this stuff out, or I can point out that from:
  https://github.com/syscomet/sieve-connect/commit/1dd818b5f087966d9bdecc44dcc60f9b0350635e

you want line 49/49 (old/new), 87/97, 1880/2084 and new 554-562. Slightly nicer if you take the full 554-565 and then the new 572-587 too, for improved diagnostics, but not strictly necessary.

[Launchpad Janitor (janitor)]

[Expired for sieve-connect (Ubuntu) because there has been no activity for 60 days.]