openSUSE Leap 15.3: 2021:2892-1 Moderate: Dovecot Security Update

This update for dovecot23 fixes the following issues:

Update dovecot to version 2.3.15 (jsc#SLE-19970):

Security issues fixed:

- CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in

JWT tokens. This may be used to supply attacker controlled keys to

validate tokens, if attacker has local access. (bsc#1187418) Local

attacker can login as any user and access their emails

- CVE-2021-33515: On-path attacker could have injected plaintext commands

before STARTTLS negotiation that would be executed after STARTTLS

finished with the client. (bsc#1187419) Attacker can potentially steal

user credentials and mails

* Disconnection log messages are now more standardized across services.

They also always now start with "Disconnected" prefix.

* Dovecot now depends on libsystemd for systemd integration.

* Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.

* config: Some settings are now marked as "hidden"....