uw-imap (8:2007f~dfsg-6) unstable; urgency=medium

  * [CVE-2018-19518] 2013_disable_rsh.patch (new): Disable access to IMAP
    mailboxes through running imapd over rsh, and therefore ssh (Closes:
    #914632). Code using the library can enable it with tcp_parameters()
    after making sure that the IMAP server name is sanitized.

 -- Magnus Holmgren <holmgren@debian.org>  Tue, 26 Feb 2019 23:35:43 +0100

CVE: CVE-2018-19518
Upstream-Status: Inactive-Upstream [lastrelease: 2007]
Signed-off-by: Peter Marko <peter.marko@siemens.com>

--- a/src/osdep/unix/Makefile
+++ b/src/osdep/unix/Makefile
@@ -988,7 +988,7 @@ onceenv:
 	 -DMD5ENABLE=\"$(MD5PWD)\" -DMAILSPOOL=\"$(MAILSPOOL)\" \
 	 -DANONYMOUSHOME=\"$(MAILSPOOL)/anonymous\" \
 	 -DACTIVEFILE=\"$(ACTIVEFILE)\" -DNEWSSPOOL=\"$(NEWSSPOOL)\" \
-	 -DRSHPATH=\"$(RSHPATH)\" -DLOCKPGM=\"$(LOCKPGM)\" \
+	 -DLOCKPGM=\"$(LOCKPGM)\" \
 	 -DLOCKPGM1=\"$(LOCKPGM1)\" -DLOCKPGM2=\"$(LOCKPGM2)\" \
 	 -DLOCKPGM3=\"$(LOCKPGM3)\" > OSCFLAGS
 	echo $(BASELDFLAGS) $(EXTRALDFLAGS) > LDFLAGS
