Sendmail Open Source MTA
Sendmail, Inc., and the Sendmail Consortium announce the availability of sendmail 8.14.5. This version fixes a few problems, including:
- SMTP extensions are no longer cached across connections as the cache is based on hostname which may not be a unique identifier for a server, i.e., different machines may have the same hostname but provide different SMTP extensions.
- An out-of-bounds access is avoided in case a resolver reply for a DNS map lookup returns a size larger than 1K.
- The interrupt signal handler has been cleaned up to avoid invoking functions that are not signal-safe.
- At most two AUTH lines are read from a server to avoid a DoS attack against the client (memory exhaustion).
A complete list of changes can be found in the release notes.
Please send bug reports and general feedback to one of the addresses listed at one of the following addresses.
The version can be found at:
If a server offers two AUTH lines, the MTA would not read them after STARTTLS has been used and hence SMTP AUTH for the client side would fail. Problem noted by Lena. A patch (signature) is available.
You either need the first two files or the third and fourth, i.e., the gzip'ed version or the compressed version and the corresponding sig file. The PGP signature was created using the Sendmail Signing Key/2011, available on the web site (http://www.sendmail.com/sm/open_source/download/) or on the public key servers.
Since sendmail 8.11 and later includes hooks to cryptography, the following information from OpenSSL applies to sendmail as well.
PLEASE REMEMBER THAT EXPORT/IMPORT AND/OR USE OF STRONG CRYPTOGRAPHY SOFTWARE, PROVIDING CRYPTOGRAPHY HOOKS OR EVEN JUST COMMUNICATING TECHNICAL DETAILS ABOUT CRYPTOGRAPHY SOFTWARE IS ILLEGAL IN SOME PARTS OF THE WORLD. WHEN YOU IMPORT THIS PACKAGE TO YOUR COUNTRY, RE-DISTRIBUTE IT FROM THERE, OR EVEN JUST EMAIL TECHNICAL SUGGESTIONS, OR EVEN SOURCE PATCHES TO THE AUTHOR OR OTHER PEOPLE, YOU ARE STRONGLY ADVISED TO PAY CLOSE ATTENTION TO ANY EXPORT/IMPORT AND/OR USE LAWS WHICH APPLY TO YOU.
THE AUTHORS ARE NOT LIABLE FOR ANY VIOLATIONS YOU MAKE HERE. SO BE CAREFUL, IT IS YOUR RESPONSIBILITY.
Show Release Notes