Changelog for fetchmail-6.6.1-218.1.x86_64.rpm :

* Mon May 11 2026 Angel Yankov - bsc#1263944 Fix multiple issues caused by fixes for immutable mode jsc#PED-14745
* Fix permissions of /var/log/fetchmail directory
* Make logrotate run as fetchmail to avoid privellege escalation attacks
* Fix permissiosn of /var/lib/fetchmail
* Configure correct logfile for daemon, create logfile
* Fri May 08 2026 Christian Boltz - fix permissions of /var/lib/fetchmail/ - user \"fetchmail\" needs to write there (as before the move to systemd-tmpfiles)
* Mon May 04 2026 Angel Yankov - Fix package for immutable mode jsc#PED-14745
* Moved /var/lib/fetchmail to generated with systemd-tmpfiles
* Moved /var/log/fetchmail logfile to inside /var/log/fetchmail directory
* Updated fetchmail.logrotate, fetchmail.tmpfiles
* Mon Nov 17 2025 Angel Yankov - Update to 6.6.1
* fixed several bugs in SMTP AUTH [#]# TRANSLATIONS were updated by these fine people (randomized order):
* sr: Мирослав Николић [Serbian]
* es: Cristian Othón Martínez Vera [Spanish]
* Mon Oct 20 2025 Angel Yankov - Update to 6.5.7
* More fixes for SMTP bugs and others [#]# BUGFIXES:
* When authenticating to an SMTP server, the AUTH LOGIN method (which didn\'t become a proposed standard, and is only the third method fetchmail would try, if CRAM-MD5 and PLAIN weren\'t offered) required that the server returned a 334 code followed by a blank and by a decodable base64 challenge we ignored anyways. This is in line with RFC 4952. However, to improve compatibility, fetchmail now accepts anything that starts with \"334 \" and disregards the remainder of the line. At the same time, AUTH LOGIN was deprecated. AUTH PLAIN should be available everywhere AUTH LOGIN is, and is specified in IETF RFC 4616.
* When authenticating to an SMTP server, i. e. esmtpname/esmtppassword are defined, check for errors, and skip servers that do not understand EHLO, because we cannot negotiate supported authentication schemes with them. This should avoid attempting to send a lot of messages and see them rejected.
* When authenticating to an SMTP server, do not send client abort \"
*\" when we receive any other server reply but 334.
* Extend 6.5.6\'s RFC-5321 address-literal fix to MAIL FROM. This might apply when we only have a server\'s IP address and need to quality addresses without domain. Fixes Debian Bug#1080025.
* SMTP AUTH can now look up passwords from the .netrc file - for that, fetchmail\'s esmtpname setting must match the login for the given host in .netrc. Fixes Debian Bug#1056651 by Ticker Berkin.
* Improve the GSSAPI (Kerberos V) build, which was pretty hard to get working. This was improved. Recommendation: - For autoconf builds (./configure), be sure to have the desired krb5-config executable early on $PATH before running ./configure. - For meson builds, be sure to list the path to your krb5-gssapi.pc file on PKG_CONFIG_PATH. (meson will fall back to krb5-config, so if that\'s on PATH, that should also work.)
* Tue Oct 07 2025 Angel Yankov - Update to 6.5.6 fixes [bsc#1251194,CVE-2025-61962]
* Rebased fetchmail-add-passwordfile-and-passwordfd-options.patch
* Rebased fetchmail-add-query_to64_outsize-utility-function.patch
* Rebased fetchmail-bump-max-passwordlen-to-1bytes.patch
* Rebased fetchmail-give-each-ctl-it-s-own-copy-of-password.patch
* Rebased fetchmail-increase-max-password-length-to-handle-oauth-tokens.patch
* Rebased fetchmail-re-read-passwordfile-on-every-poll.patch
* Rebased fetchmail-support-oauthbearer-xoauth2-with-pop3.patch
* SECURITY BUGFIX:
* fetchmail-SA-2025-01.txt: CVE pending assignment by MITRE An SMTP server advertising EHLO and AUTH, and if fetchmail is configured to authenticate (esmtpname and esmtppassword given and non-empty), the server might crash fetchmail by sending a \"334\" response without further blank to fetchmail\'s AUTH request. This is in violation of applicable RFC-4952 though. Fetchmail now detects this situation and reports it separately as malformed server reply. Fetchmail 6.5.6 has been released without waiting for translation updates or CVE identifier, these will be provided in followup releases.
* BUGFIXES:
* RFC-5321: When the --smtpaddress, --smtphost, --smtpname, -D or -S argument is an numeric address literal such as 192.0.2.2 or 2001:0DB8::4321, properly format that as such in the SMTP RCPT command as userAATT[192.0.2.2] or userAATT[IPv6:2001:0DB8::4321].
* When printing output on the console while fetching mail, do not intersperse another copy of our program name and date in the middle of a log line. Workaround for older versions: --logfile /dev/tty (might also use - -logfile /dev/stderr) - but note this changes buffering behavior and may output to appear later and without ticker marks.
* A few low-priority memory leaks in the command-line options parser were fixed. Since this parser runs only once, leaks are harmless.
* Some minor code cleanups and robustness fixes were made, and we should see fewer compiler warnings as a result.
* CHANGES:
* Given the slow update schedules of some distributions, already add code that checks if time_t() is good beyond the year 2038, meaning time_t is either unsigned (which would last until 2106) or 64 bits wide. If the system isn\'t safe, warn on every launch of fetchmail beginning 2028-01-01 at 00:00 GMT so users have 10 years to plan. Fetchmail will also print a warning if time(time_t
*t) overflows.
* Thu Jun 26 2025 Angel Yankov - Update to 6.5.4
* BUGFIXES:
* socket: avoid crash when writing to a socket without SSL/TLS fails. Reported by Andrea Venturoli via mailing list, fixes #71.
* wolfSSL support: avoid fetchmail.c compilation failure in certain configurations of wolfSSL (for instance, on FreeBSD\'s wolfssl-5.8.0_1 package), OpenSSL_version enables a newer 1.1.x compat API that passes its argument to a wolfSSL API, with OPENSSL_DIR and OPENSSL_ENGINES_DIR, causing related compiler failures. See .
* Tue Jan 14 2025 Angel Yankov - Update to 6.5.2
* TRANSLATIONS: fetchmail\'s translations were updated, courtesy of:
* cs: Petr Pisar [Czech]
* sr: Мирослав Николић (Miroslav Nikolić) [Serbian]
* CHANGES:
* Minor documentation consistency fixes (versions, dates).
* Tue Nov 26 2024 Angel Yankov - Upgrade to 6.5.1
* Drop two wolfSSL compile-time checks that were for older 6.4 or for future 7.0 releases and broke compilation with wolfSSL 5.7.4. Fixes https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=282413#c4
* Use %p instead of non-portable %#p for one wolfSSL-related diagnostic message (FreeBSD defines %#p to be %p, on many other platforms it\'s undefined behavior).
* Add regex_helper.c to list of files that contain translatable strings, which contains two strings we missed to translate.
* Simplify EVP_MD_fetch API detection (\"like OpenSSL 3\" vs. \"like OpenSSL 1\") for version switch and base it on the claimed OpenSSL version of the crypto SSL, which works for LibreSSL (claims OpenSSL 2) and wolfSSL alike.
* Several translations added - Rebased fetchmail-6.3.8-smtp_errors.patch - Rebased fetchmail-FAQ-list-gmail-options-including-oauthbearer-and-app.patch - Rebased fetchmail-add-contrib-fetchnmail-oauth2.py-token-acquisition-u.patch - Rebased fetchmail-add-imap-oauthbearer-support.patch - Rebased fetchmail-add-passwordfile-and-passwordfd-options.patch - Rebased fetchmail-add-query_to64_outsize-utility-function.patch - Rebased fetchmail-bump-max-passwordlen-to-1bytes.patch - Rebased fetchmail-give-each-ctl-it-s-own-copy-of-password.patch - Rebased fetchmail-increase-max-password-length-to-handle-oauth-tokens.patch - Rebased fetchmail-re-read-passwordfile-on-every-poll.patch - Rebased fetchmail-support-oauthbearer-xoauth2-with-pop3.patch - Rebased fetchmailconf-no-more-future.patch
* Thu Apr 04 2024 Dirk Müller - update to 6.4.38:
* Tighten OpenSSL and wolfSSL version requirements again. See README.SSL.
* Distributors providing older versions that they backport security fixes for may want to patch socket.c but remember to redirect support to your distribution\'s support channels. The fetchmail maintainer only supports functionally unmodified builds with publicly available SSL/TLS library versions.
* fetchmail will refuse to build against OpenSSL 1.0.2 older than 1.0.2u, or wolfSSL older than 5.6.2. It will warn about OpenSSL older than 3.0.9, or between 3.1.0 and 3.1.4, or wolfSSL older than 5.6.6.
* Wed Jan 17 2024 Steve Kowalik - Add patch fetchmailconf-no-more-future.patch:
* Drop requirement for python-future from fetchmailconf.
* Wed Mar 01 2023 David Anes - Update to 6.4.37:
* TRANSLATIONS: language translations were updated: - sr [Serbian]
* Tue Feb 07 2023 David Anes - Update to 6.4.36:
* TRANSLATIONS: language translations were updated: - cs, es, fr, ja, pl, ro, sq, sv
* Sat Jan 21 2023 Dirk Müller - disable opie support
* Thu Jan 05 2023 David Anes - Update to 6.4.35:
* BREAKING CHANGES: - Fetchmail now warns about OpenSSL before 1.1.1s or 3.0.7, and rejects wolfSSL older than 5.5.0.
* Updated Swedish and Esperanto translations.