postfix: Update to version 3.11.6

- Update from version 3.11.5 to 3.11.6
- No change in rootfile
- Changelog
3.11.6
These defects were found by Qualys assisted by Claude Mythos Preview, and by OpenAI
 Security; more than half date from 20 or more years ago. When I implemented Postfix,
 I knew that there were going to be mistakes. That is the reason why Postfix has its
 architecture and safety nets. The number of defects may seem large, but considering
 that they were found in a code base of over 150 thousand lines, the error rate is
 still lower than what I designed for.
Policy bypass:
    Bug (introduced: Postfix 2.2, date: 20041102): missing SMTP server resets of
	MAIL FROM and RCPT TO command state after smtpd_end_of_data_restrictions
	rejected a message. This resulted in SMTP protocol state desynchronization
	between the remote SMTP client and the Postfix SMTP server.
    A crafted remote SMTP client could then send RCPT TO and DATA without MAIL FROM,
	and deliver a second message. Then, smtpd_end_of_data_restrictions skipped
	check_recipient_access constraints, because a recipient counter was > 1.
	Reported by OpenAI Security. File: smtpd/smtpd.c.
    As reported by OpenAI Security, the failure to reset MAIL FROM and RCPT TO state
	also affected Milter support (added in Postfix 2.3). Here, after a Milter
	replied with "accept this message" based on the message envelope, and
	smtpd_end_of_data_restrictions rejected the message, the Postfix SMTP server
	as before accepted RCPT TO and DATA without MAIL FROM, and
	smtpd_end_of_data_restrictions as before skipped check_recipient_access
	constraints for the second message. Under these conditions, the Postfix
	Milter client remained in the "accept this message" state, skipping Milter
	policy enforcement for the second message.
Denial of service:
    Bug (defect introduced: Postfix 3.4, date: 20180805): SMTP server command
	history memory exhaustion with a large number of very small BDAT requests.
	Reported by OpenAI security. File: smtpd.c.
    Bug (defect introduced: Postfix 1.1, date: 20021116): address verification cache
	poisoning. A local user could use the postdrop command to submit an address
	verification probe with envelope or message content that Postfix rejected
	later, resulting in a negative address verification cache entry for that
	address. On systems that enable address verification, the negative address
	verification cache entry would force the Postfix SMTP server to reject a
	message that it should accept (denial of service). Problem reported by
	OpenAI Security. File: postdrop.c.
Server crashes and panic()s:
    Bug (defect introduced: Postfix 3.4, date: 20180805): missing SMTP server reset
	of RCPT TO state, after a BDAT command error. A crafted remote SMTP client
	could then send a DATA command without MAIL FROM or RCPT TO, and crash a
	Postfix SMTP daemon process with a null pointer read error. Reported by
	OpenAI Security. File: smtpd/smtpd.c.
    Bug (defect introduced: Postfix 2.4, date: 20051222): null pointer read crash
	while parsing a malformed Dovecot AUTH server response. Reported by Qualys,
	assisted by Claude Mythos Preview. File: xsasl_dovecot_server.c.
Read after free, uninitialized read, under/over read:
    Bug (defect introduced: Postfix 2.8, date: 20100914): read-after-free in the
	PSC_CALL_BACK_NOTIFY() macro. This had no effect on program execution,
	because myfree() wiped memory, and that memory was not yet reused. Problem
	reported by Qualys, assisted by Claude Mythos Preview. File: postscreen_dnsbl.c.
    Read after free (no privilege escalation) in debug logging (defect introduced:
	Postfix 2.2, date: 20050117). Reported by Qualys, assisted by Claude Mythos
	Preview. File: util/inet_connect.c.
    Bug (defect introduced: Postfix 2.10, date: 20120617): uninitialized memory read
	in postscreen HaProxy client after remote I/O exception, causing garbage to
	be logged. Reported by Qualys, assisted by Claude Mythos Preview.
	File: postscreen_haproxy.c.
    Latent bug (defect introduced: Postfix 2.7, date: 20090618): uninitialized memory
	read after dnsblog(8) returns a string that is not an IPv4 address. Reported
	by Qualys, assisted by Claude Mythos Preview. File: postscreen_dnsbl.c.
    Bug (defect introduced: before Postfix alpha, date 19970424): the DNS client
	could read up to two bytes past the end of an MX record, before discovering
	that the record was too short. This behavior was later copied with SRV
	records, potentially over-reading up to six bytes. Problem reported by
	Qualys, assisted by Claude Mythos Preview. File: dns_lookup.c.
    Bug (defect introduced: Postfix 1,1, date: 20010524): the postsuper command
	under-read or over-read a very short queue filename. No crash, information
	leak, or privilege escalation. Reported by Qualys, assisted by Claude Mythos
	Preview. Files: postsuper.c, mail_queue.h.
Other code hygiene:
    Bug (defect introduced: before Postfix alpha, date: 19971106): 'int' over-shift,
	in the queue file record-length parser. Postfix programs do not generate such
	records, but an attacker could cause postdrop to reject input or panic().
	Reported by Qualys, assisted by Claude Mythos Preview. File: record.c.
    Bug (defect introduced: Postfix 2.2, date: 20050117): non-transitive comparison
	of IPv4 addresses. Reported by Qualys, assisted by Claude Mythos Preview.
	File: sock_addr.c.
    Bug (defect introduced: Postfix 1.0, date: 20000928): the fast flush server, used
	by the SMTP command "ETRN", and by the commands "postqueue -s site" and
	"postqueue -i queue_id" (and their sendmail(1) equivalents), used the wrong
	duplicate suppression API, resulting in unnecessary queue scans by the queue
	manager. Reported by Qualys, assisted by Claude Mythos Preview. File: flush.c.
    Queue hygiene: the postdrop command accepted the null record type which the rest
	of Postfix ignores. Reported by OpenAI Security. File: postdrop.c.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/postfix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)