[request-tracker-maintainers] Bug#674962: Bug#674962: Outgoing email no longer works due to security patch regression

[Dominic Hargreaves]

forcemerge 674522 674962
thanks

On Mon, May 28, 2012 at 05:34:05PM -0700, Chris Kloosterman wrote:
> Package: request-tracker3.8
> Version: 3.8.8-7+squeeze2
> 
> After upgrading to the latest security patch, some outgoing email is
> not working anymore.  Specifically, some emails generated by RT have
> no To: header, but several addresses in Bcc:.  In this case, I've
> started getting log entries in my mail.log:
> 
> May 28 17:00:14 webserver postfix/sendmail[1239]: fatal: www-data(33):
> No recipient addresses found in message header
> 
> The email generated by RT is rejected by postfix and is not relayed.
> The email is then silently dropped by RT and is never seen again.
> 
> Emails generated by RT are an important part of our workflow.  Right
> now we're not getting notified when new tickets arrive.
> 
> It appears that the reason for this is that the default outgoing email
> configuration uses "sendmailpipe" which includes the "-t" argument.
> Since no "To:" headers are present, sendmail gives up and drops the
> message without sending it.  I don't know why the behaviour has
> suddenly changed, though, with the latest RT security patch.

This was indeed a bug in the RT security patch which should be
addressed by a follow-up DSA soon (see
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=674522 for more
details).

Apologies for the inconvience.

-- 
Dominic Hargreaves | http://www.larted.org.uk/~dom/
PGP key 5178E2A5 from the.earth.li (keyserver,web,email)