-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Proofpoint, Inc., and the Sendmail Consortium announce the availability
of sendmail 8.18.1. This version enforces stricter RFC compliance
by default, especially with respect to line endings. This may cause
issues with receiving messages from non-compliant MTAs; please see
the first release note below for mitigations. It also adds full
DANE support provided an OpenSSL version with the required DANE
functions is used. For a complete list, see the release notes
below.

Please send bug reports and general feedback to one of the addresses
listed at: http://www.sendmail.org/email-addresses.html https://www.proofpoint.com/us/products/email-protection/open-source-email-solution

The version can be found at
https://ftp.sendmail.org/sendmail.8.18.1.tar.gz https://ftp.sendmail.org/sendmail.8.18.1.tar.gz.sig https://ftp.sendmail.org/sendmail.8.18.1.tar.Z https://ftp.sendmail.org/sendmail.8.18.1.tar.Z.sig

(or via ftp://ftp.sendmail.org/pub/sendmail/)

SHA-256 checksums
SHA256 (sendmail.8.18.1.tar.gz) = cbf1f309c38e4806f7cf3ead24260f17d1fe8fb63256d13edb3cdd1a098f0770
SHA256 (sendmail.8.18.1.tar.gz.sig) = 5e54a10405d786de23f9752ef6c5add1dba8e77af610956c18357841df94caca
SHA256 (sendmail.8.18.1.tar.Z) = c948661d51b7e5918e2d57b296be3c79e1dde8c7aa3791efec2dba29eb575de2
SHA256 (sendmail.8.18.1.tar.Z.sig) = a8ce8d7507aecf9149a92d8b789d2c1ec496a5e8d2613aa0aac2709894953c11

You either need the first two files or the third and fourth,
i.e., the gzip'ed version or the compressed version and the
corresponding sig file. The PGP signature was created using
the Sendmail Signing Key/2024, available on the web site (http://www.sendmail.com/sm/open_source/download/) or on
the public key servers (keyid C71F6844).

Since sendmail 8.11 and later includes hooks to cryptography, the
following information from OpenSSL applies to sendmail as well.

PLEASE REMEMBER THAT EXPORT/IMPORT AND/OR USE OF STRONG CRYPTOGRAPHY
SOFTWARE, PROVIDING CRYPTOGRAPHY HOOKS OR EVEN JUST COMMUNICATING
TECHNICAL DETAILS ABOUT CRYPTOGRAPHY SOFTWARE IS ILLEGAL IN SOME
PARTS OF THE WORLD. SO, WHEN YOU IMPORT THIS PACKAGE TO YOUR
COUNTRY, RE-DISTRIBUTE IT FROM THERE OR EVEN JUST EMAIL TECHNICAL
SUGGESTIONS OR EVEN SOURCE PATCHES TO THE AUTHOR OR OTHER PEOPLE
YOU ARE STRONGLY ADVISED TO PAY CLOSE ATTENTION TO ANY EXPORT/IMPORT
AND/OR USE LAWS WHICH APPLY TO YOU. THE AUTHORS ARE NOT LIABLE FOR
ANY VIOLATIONS YOU MAKE HERE. SO BE CAREFUL, IT IS YOUR RESPONSIBILITY.

SENDMAIL RELEASE NOTES


This listing shows the version of the sendmail binary, the version
of the sendmail configuration files, the date of release, and a
summary of the changes in that release.


8.18.1/8.18.1 2024/01/31
sendmail is now stricter in following the RFCs and rejects
some invalid input with respect to line endings
and pipelining:
- Prevent transaction stuffing by ensuring SMTP clients
wait for the HELO/EHLO and DATA response before sending
further SMTP commands. This can be disabled using
the new srv_features option 'F'. Issue reported by
Yepeng Pan and Christian Rossow from CISPA Helmholtz
Center for Information Security.
- Accept only CRLF . CRLF as end of an SMTP message
as required by the RFCs, which can disabled by the
new srv_features option 'O'.
- Do not accept a CR or LF except in the combination
CRLF (as required by the RFCs). These checks can
be disabled by the new srv_features options
'U' and 'G', respectively. In this case it is
suggested to use 'u2' and 'g2' instead so the server
replaces offending bare CR or bare LF with a space.
It is recommended to only turn these protections off
for trusted networks due to the potential for abuse.
Full DANE support is available if OpenSSL versions 1.1.1 or 3.x
are used, i.e., TLSA RR 2-x-y and 3-x-y are supported
as required by RFC 7672.
OpenSSL version 3.0.x is supported. Note: OpenSSL 3 loads by
default an openssl.cnf file from a location specified
in the library which may cause unwanted behaviour
in sendmail. Hence sendmail sets the environment
variable OPENSSL_CONF to /etc/mail/sendmail.ossl
to override the default. The file name can be
changed by defining confOPENSSL_CNF in the mc file;
using an empty value prevents setting OPENSSL_CONF.
Note: referring to a file which does not exist does
not cause an an error.
Two new values have been added for {verify}:
"DANE_TEMP": DANE verification failed temporarily.
"DANE_NOTLS": DANE was required but STARTTLS was not
offered by the server.
The default rules return a temporary error for these
cases, so delivery is not attempted.
If the TLS setup code in the client fails and DANE requirements
exist then {verify} will be set to "DANE_TEMP" thus
preventing delivery by default.
DANE related logging has been slightly changed for clarification:
"DANE configured in DNS but no STARTTLS available"
changed to
"DANE configured in DNS but STARTTLS not offered"
When the compile time option USE_EAI is enabled, vacation could
fail to respond when it should (the code change in
8.17.2 was incomplete). Problem reported by Alex
Hautequest.
If SMTPUTF8 BODY=7BIT are used as parameters for the MAIL command
the parsing of UTF8 addresses could fail (USE_EAI).
If a reply to a previous RCPT was received while sending
another RCPT in pipelining mode then parts of the
reply could have been assigned to the wrong RCPT.
New DontBlameSendmail option CertOwner to relax requirement
for certificate public and private key ownership.
Based on suggestion from Marius Strobl of the
FreeBSD project.
clt_features was not checked for connections via Unix domain
sockets.
CONFIG: FEATURE(`enhdnsbl') did not handle multiple replies
from DNS lookups thus potentially causing random
"false negatives".
Note: the fix creates an incompatibility:
the arguments must not have a trailing dot anymore
because the -a. option has been removed (as it only
applies to the entire result, not individual values).
CONFIG: New FEATURE(`fips3') for basic FIPS support in OpenSSL 3.
VACATION: Add support for Return-Path header to set sender
to match OpenBSD and NetBSD functionality.
VACATION: Honor RFC3834 and avoid an auto-reply if
'Auto-Submitted: no' is found in the headers to
match OpenBSD and NetBSD functionality.
VACATION: Avoid an auto-reply if a 'List-Id:' is found in
the headers to match OpenBSD functionality.
VACATION: Add support for $SUBJECT in .vacation.msg which
is replaced with the first line of the subject of the
original message to match OpenBSD and NetBSD
functionality.
Portability:
Add support for Darwin 23.
New Files:
cf/feature/fips3.m4
devtools/OS/Darwin.23.x
-----BEGIN PGP SIGNATURE-----

iQIcBAEBAgAGBQJlugFVAAoJEMQGWofHH2hEwLgP/jxAl+rxBoyPrxlFVBZzi8Lr wD59bQHYhHGLnt3L/tNGm1QmTaps1Ex1TWEAYCC4WT6i7oMD8XLIYWDswHPDjPAq M9FcneU3hL6XAP7Nqdg9F/snDYe1hQ3UUOAXd4e7Yjmux5l4yRLmDCI+F7lZNJ9s dFdjiX1GTiAe60c0KshZHtgSK+88VLQzkseLNELLWXAKdyYn2mFI7ErjdLmlTd4x +AADBizArCKH6IfN6EVXOEm7XYXksexXIqG3IcrwzjSx/oHHTj34Lm/QhQ50Xez1 wi+KydI2hvfOTecbCZDHcUDsTxT9kQsylLDRuw4ivM2yoJCVcM9akhyfWAhA2igQ 2cN8C6CHZvVhOzlEnOCVshtInGe6U3EXzAFTPn+p7sWpWMM447nkSFkWbDdZGR9b 8KRvpGWC9cqLaXfGcQzs0NBik9M86kFVm3wT2GpDYyAJbRX0RpeBr6ql/z1ryx6O Dn5EBE9XMIGI+cpWtH7fmiUjgilZFYag3MavmtrSvGa2RAefC9yts7JyxpDiPR4k fb/7UXGmWv0XDKo6QYGdB2zwOPEphUQiPpJcMIbIKCBV2weL4ZEF2pDUZ4y8P5jR miOlsic6R5GG9dhvHIDpSKFMCZK2XaPkjgj7SDv0cVaragdT5yrdfRkLU+PCrtTe mhclJirDeydr7CZ6zhZk
=oxc4
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)