Cyrus IMAP 3.4.1 Release Notes

Download from GitHub:

• https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.1/cyrus-imapd-3.4.1.tar.gz

• https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.1/cyrus-imapd-3.4.1.tar.gz.sig

Changes since 3.4.0

Security fixes:

• Fixed CVE-2021-32056: Remote authenticated users could bypass intended access restrictions on certain server annotations. Additionally, a long-standing bug in replication did not allow server annotations to be replicated. Combining these two bugs, a remote authenticated user could stall replication, requiring administrator intervention.

Build changes

• Fixed Issue #3462: using GLIBC-only macro to check for GCC features (thanks Andy Fiddaman)

Bug fixes

• Fixed Issue #3456: per-server annotations were unable to replicate

• Fixed Issue #3468: ctl_cyrusdb -r assertion on startup when mboxlist_db configured to "skiplist" (thanks Felix J. Ogris)

• Fixed: JMAP email updates must result in non-empty mailboxIds

• Fixed: output JMAP dates as Dates, not UTCDates

Fixes to nonstandard JMAP extensions

(These extensions are not yet formally standardised, and are only available with the jmap_nonstandard_extensions imapd.conf(5) option enabled.)

• Fixed: JMAP Calendars Extension - gracefully handle empty property values

• Fixed: JMAP Calendars Extension - ignore empty string default values in events

• Fixed: JMAP Calendars Extension - do not use Participant.email for scheduling