CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

mail/qmail 1.06_7

Secure, reliable, efficient, simple, and fast MTA

Port info

Maintainer
erdgeist@erdgeist.org
Packages
latest: 1.06_7
Upstream
up to date
Last update
to 1.06_7 · fff227115a
Quarterly
2026Q4: 1.06_7
WWW
https://cr.yp.to/qmail.html
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install netqmail
installs 1.06_7 from latest; from quarterly (2026Q4) 1.06_7
Port
# cd /usr/ports/mail/qmail && make install clean
# make -C /usr/ports/mail/qmail config  # change options first
Size
258 KiB download · 1.0 MiB installed
Depends on
nothing
Creates
user alias, qmaild, qmaill, qmailp, qmailq, qmailr, qmails, group qmail, qnofiles
Options
3 of 16 on in the package: DNS_CNAME DOCS RCDLINK
Show the 13 options that are off
BIG_CONCURRENCY_PATCH BIG_TODO_PATCH BLOCKEXEC_PATCH DISCBOUNCES_PATCH EXTTODO_PATCH LOCALTIME_PATCH MAILDIRQUOTA_PATCH OUTGOINGIP_PATCH QEXTRA QMTPC_PATCH SMTP_AUTH_PATCH SPF_PATCH TARPIT_PATCH
pkg-message
Shown after installing
ATTENTION:

You can enable qmail as your default mailer executing:
> /var/qmail/scripts/enable-qmail

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.06_71.06_7–
FreeBSD 151.06_71.06_7–
FreeBSD 141.06_71.06_71.06_7

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.06_71.06_7–
FreeBSD 141.06_71.06_71.06_7

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (2)

The CVE record lists the packaged version 1.06_7 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2020-38117.52020-05-26qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.
CVE-2020-38125.52020-05-26qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories anywhere …

VuXML only (0)

Listed in VuXML, the packaged version 1.06_7 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (287)

Bryan Drewery (bdrewery)
Fix CONFLICTS with netqmail-tls after PKGNAME rename in r359176
ae44dfc7b8
Bryan Drewery (bdrewery)
mail/qmail-tls: Update to 20110119 and use netqmail base

Changes:
  2011-01-19
    * flush_io after starttls, bug described in http://www.kb.cert.org/vuls/id/555316 (Wietse Venema)

  2007-04-08
    * type correction of time argument in ssl_timeoutio functions
    * bug in tlsserversciphers processing (Michael Hanselmann)
    * RFC1891 (James Couzens)

  2006-01-04
    * strerror declaration in tls.c compile problem (Renato Botelho, Bill Shupp)
    * chown uid.gid deprecated, should be uid:gid (Bill Shupp)

  2005-03-29
    * no STARTTLS advertised when control/servercert.pem absent (Jason Haar) [already fixed in qmail-tls]
    * control/notlshosts (Albert Weichselbraun)
    * control/tlshosts/exhaustivelist
    * scripts honor conf-users (Sven Verdoolaege)

  2004-04-17
    * bug: qmail-remote loops on malformed server response (B. Shupp, A. Meltzer) [already fixed in qmail-tls]

  2004-01-20
    * bug: DH caused exit if dh512.pem and dh1024.pem absent (Samuli Karkkainen)

  2003-12-27
    * script for update temporary RSA/DH temp keys
    * CRL checking of clients
    * Diffie-Hellman parameters added
    * RFC 2821 compliance of headers (Matthias Wimmer)
    * bug: sk_GENERAL_NAME_pop_free call (Joe Orton)
c52e4206bb
Bryan Drewery (bdrewery)
Fix CONFLICTS after qmail->netqmail rename
d659d91fb5
Bryan Drewery (bdrewery)
Fix nit, QMAIL_PORTNAME was not set after r358497
e112559e39
Bryan Drewery (bdrewery)
- Add DNS_CNAME option to switch from using ANY queries, which was a hack   added many years ago for BIND 4. Using CNAME avoids excessive data in   DNS query responses and temporary failures.

This was already applied in spamcontrol.

  See also:
    http://homepage.ntlworld.com./jonathan.deboynepollard/Softwares/qmail/
    https://www.google.com/#q=CNAME_lookup_failed_temporarily

Submitted by:	Matt Simerson <matt@tnpi.net>
79a2bb25a8
Bryan Drewery (bdrewery)
Switch mail/qmail and mail/qmail-mysql to using netqmail. Switch their PKGNAMEs to reflect this as well and bump their version up to the last netqmail release of 1.06.

qmail-ldap and qmail-spamcontrol explicitly want to be applied on stock
qmail, so leave those alone.

This does not bring much, but it allows easier updates to qmail-tls and
some of the other patches which depend on netqmail.

qmail-tls is left as qmail for now. It will be updated to the newer
revision soon which does require netqmail.

Changes include:
  * QMAILQUEUE by default
  * Fix for 0.0.0.0
  * qmail-smtpd is protected from exceedingly long (eg 2GB) headers

Other than those listed, there are no other significant changes beyond
documentation or patches that were already applied by default.
bf48a40a29
Bryan Drewery (bdrewery) · 1.03_11
- Scale FD_SETSIZE with WITH_BIG_CONCURRENCY_PATCH_CONCURRENCY_LIMIT

Submitted by:	Joe Schaefer <joe_schaefer@yahoo.com>
83febfdab5
Bryan Drewery (bdrewery) · 1.03_10
- Don't try removing /var/qmail/queue at all - Remove /var/qmail/queue from STAGEDIR so it's not an orphan
c0ec093f32
Bryan Drewery (bdrewery) · 1.03_9
mail/qmail, mail/qmail-tls, mail/qmail-mysql, mail/qmail-spamcontrol:

- Support stagedir
- Fix all leftovers
  Note that this depends on new Mk/Scripts/check_leftovers.sh added in r351446.
- Bump PORTREVISION in all ports due to plist being fixed.
- Support man.d on FreeBSD 9+
- Convert NOPORTDOCS
- Fix bad perl shebang for scripts/mkaliasdir
- Remove pkg-install and move all to pkg-plist
- Fix /var/qmail modified warning in poudriere by doing nothing in
  install-mtree
- Fix /var/qmail getting unpredictable/wrong permissions due to
  USERS/GROUPS changing for every user with HOME=/var/qmail
- Use more OPTIONS helpers
- Fix ccache support for spamcontrol patch building
- Fix build of SMTPEXTFORK in mail/qmail-spamcontrol with recent clang

Tested with:	pkg and pkg_install
9c859f6f6e
Baptiste Daroussin (bapt) · 1.03_8
Fix properties on pkg-plist
e04b632220
Bryan Drewery (bdrewery) · 1.03_8
- Add NO_STAGE until validated to be safe for upcoming staging support
2324655f20
Bryan Drewery (bdrewery) · 1.03_8
Fix qmail-spamcontrol build on head without gcc

Reported by:	bapt
2c7ec98c83
Bryan Drewery (bdrewery) · 1.03_8
Add file meant for r325421
4750c6ff48
Bryan Drewery (bdrewery) · 1.03_8
- Fix build with clang and on head

Reported by:	bapt
1ffe5a449c
Andrej Zverev (az) · 1.03_8
- Convert to new perl5 framework

Approved by:	bdrewery@ (maintainer)
e22cb3e0ce
Bryan Drewery (bdrewery) · 1.03_8
- Fix spamcontrol build after r324008 removed perl from PATCH_DEPENDS   in bsd.perl.mk
32cf2e6ffe
Bryan Drewery (bdrewery) · 1.03_8
- Fix options conversion for bmake

Submitted by:	Joseph Schaefer <joesuf4@gmail.com>
3751c1c1ba
Bryan Drewery (bdrewery) · 1.03_8
- Fix qmail-mysql build with clang and recent mysql-client

Reported by:	miwi via pointyhat
aff2c3704c
Bryan Drewery (bdrewery) · 1.03_8
Add working mirror for tls patch
485d5cb399
Renato Botelho (garga) · 1.03_8
Fix typo on var name

Approved by:	maintainer
3c8c5f0b8d
Bryan Drewery (bdrewery) · 1.03_8
- Convert USE_QMAIL_RUN, USE_QMAIL_BUILD and WANT_QMAIL into USES feature   bapt contributed to the qmail.mk as well - Trim headers

USES= qmail:run will add qmail into RUN_DEPENDS
USES= qmail:build will add qmail into BUILD_DEPENDS
USES= qmail[:both] will add qmail into both RUN and BUILD DEPENDS
USES= qmail:vars will set QMAIL_PREFIX

With hat:	portmgr
63f96859ce
Bryan Drewery (bdrewery) · 1.03_8
- Fix error when QMAIL_PREFIX is not defined due to extra spaces   "Makefile", line 653: Need an operator   make: fatal errors encountered -- cannot continue
f636527174
Bryan Drewery (bdrewery) · 1.03_8
- Cleanup example rc file  - Support SHUTDOWN  - Check for needed files/dependencies in precmd  - Respect LOCALBASE  - Make rclint happy - Rename symlink from qmail.sh to qmailsmtpd - Rename installed example rc file from qmail-smtpd.rcNG to qmailsmtpd
678eff9c21
Bryan Drewery (bdrewery) · 1.03_7
- Fix runtime crash when using SMTPEXTFORK option due to   calling strtok(3) without string.h included.   Not reported "upstream" as the last update was 2009   and the site is dead.

Reported by:	Christopher Weimann <christopher@weimann.us>
7b01d09ebb
Bryan Drewery (bdrewery) · 1.03_7
- Remove indefinite article from COMMENT - Avoid directly including bsd.openssl.mk by including   bsd.port.options.mk and using proper USE_OPENSSL
1bc9954783
Renato Botelho (garga) · 1.03_7
Pass maintainership of qmail ports and bsd.mail.mk to bdrewery@. It was funny, but I'm not using qmail for a long time.
5e451ad65e
Renato Botelho (garga) · 1.03_7
- Update TLS patch to v2, what address an issue that qmail-remote loops on   malformed server response - Bump PORTREVISION

Reported by:	Dirk Engling <erdgeist@erdgeist.org>
Feature safe:	yes
ce3032abb9
Renato Botelho (garga) · 1.03_7
Fix OptionsNG commit, i committed the wrong version

Pointyhat to:	garga@
Feature safe:	yes
1f88b73f96
Renato Botelho (garga) · 1.03_7
Convert mail/qmail to OptionsNG

Feature safe:	yes
e38fe07518
Renato Botelho (garga) · 1.03_7
Fix MAILDIRQUOTA patch that was calculating the wrong email size.

PR:		ports/168870
Submitted by:	Michael Gmelin <freebsd@grem.de>
Feature safe:	yes
f73ec4c6b0
Renato Botelho (garga) · 1.03_7
Change headers of all ports maintained by me to new format
566e1b7f4e
Alex Kozlov (ak) · 1.03_7
Fix various errors in ports distinfo (yii-1.1.9.r3527.tar.gz verified against upstream sources)
014232b649
Renato Botelho (garga) · 1.03_7
Fix URL to download smtp-auth patch
c463b5c65e
Doug Barton (dougb) · 1.03_7
In the rc.d scripts, change assignments to rcvar to use the literal name_enable wherever possible, and ${name}_enable when it's not, to prepare for the demise of set_rcvar().

In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
83eb2c3700
Renato Botelho (garga) · 1.03_7
Respect CC and STRIP

PR:		ports/162492
Submitted by:	Jan Beich <jbeich@tormail.net>
Feature safe:	yes
6dcf941c1b
Adam Weinberger (adamw) · 1.03_7
Typo fix in a printed string.

Approved by:	garga (maintainer)
047e56b829
Chris Rees (crees) · 1.03_7
- Add SMTPAUTHUSER and SRS support - While here, use WANT_QMAIL rather than hideous relative include

PR:		ports/159964
Submitted by:	Nicolas de Bari Embriz <nbari@dalmp.com>
Approved by:	garga (carte blanche via email)
6757d8fc61
Renato Botelho (garga) · 1.03_7
Fix qmail, qmail-tls, qmail-mysql and qmail-ldap build with clang
df9f14e134
Renato Botelho (garga) · 1.03_7
- Make qmail use USERS and GROUPS [1] - Add my local_distfiles as a MASTER_SITES to ucspi-ssl

PR:		ports/157622 [1]
Submitted by:	crees [1]
19760f48f0
Doug Barton (dougb) · 1.03_7
Remove painful examples of foo="", with particular prejudice against constructions that parse out to [ -z "$foo" ] && foo=""

These are bad examples that get copied and pasted into new code, so the
hope is that with less bad examples there will be less need for me to
bring this up in review.

In a few of these files all that were changed were comments so that next
time I search for these patterns I won't trip on the file for no reason.

In a few places, add $FreeBSD$

No functional changes, so no PORTREVISION bumps
29813d5397
Renato Botelho (garga) · 1.03_7
- Update spamcontrol patch to 2.6.24 - Remove MD5

Feature safe:	yes
6dff9d42fb
Renato Botelho (garga) · 1.03_7
When server announce auth as "PLAIN LOGIN" instead of the common inverse order "LOGIN PLAIN" make sure qmail-remote can authenticate.
8d9c1f0443
Renato Botelho (garga) · 1.03_7
Update spamcontrol patch to 2.6.23
adc1d2316a
Renato Botelho (garga) · 1.03_7
- Really fix qmail-spamcontrol build now, i was building ucspi-ssl after   install_spamcontrol.sh and it must run before since this script need to copy   ssl.a to correct place - Bump PORTREVISION
3d5a5bc862
Renato Botelho (garga) · 1.03_7
- Add perl build dependency, missed on last commit - Bump PORTREVISION

Reported by:	QAT
eb9e6caa4d
Renato Botelho (garga) · 1.03_7
Update spamcontrol to 2.6.22
c34fd65773
Renato Botelho (garga) · 1.03_7
Fix build with utmpx

Reported by:	pointyhat by erwin@
697b95bd06
Renato Botelho (garga) · 1.03_7
Remove references pointing to PORT_NOTE, a file that doesn't exist anymore

Reported by:	Elliot Denk <elliotdenk at googlemail.com>
Feature safe:	yes
78ee99eb30
Renato Botelho (garga) · 1.03_7
Fix build on 9-CURRENT after utmp -> utmpx

Provided by:	ed@
35ffaa0b9a
Renato Botelho (garga) · 1.03_7
Define rules for PORTSCOUT checking in some of my ports
9927229e72