# Cyrus IMAP 3.4.1 Release Notes

Download from GitHub:

> - https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.1/cyrus-imapd-3.4.1.tar.gz

> - https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.4.1/cyrus-imapd-3.4.1.tar.gz.sig

## Changes since 3.4.0

### Security fixes:

- Fixed CVE-2021-32056: Remote authenticated users could bypass intended access restrictions on certain server annotations. Additionally, a long-standing bug in replication did not allow server annotations to be replicated. Combining these two bugs, a remote authenticated user could stall replication, requiring administrator intervention.

### Build changes

- Fixed Issue #3462: using GLIBC-only macro to check for GCC features (thanks Andy Fiddaman)

### Bug fixes

- Fixed Issue #3456: per-server annotations were unable to replicate

- Fixed Issue #3468: ctl_cyrusdb -r assertion on startup when mboxlist_db configured to "skiplist" (thanks Felix J. Ogris)

- Fixed: JMAP email updates must result in non-empty mailboxIds

- Fixed: output JMAP dates as Dates, not UTCDates

### Fixes to nonstandard JMAP extensions

(These extensions are not yet formally standardised, and are only available with the jmap_nonstandard_extensions imapd.conf(5) option enabled.)

- Fixed: JMAP Calendars Extension - gracefully handle empty property values

- Fixed: JMAP Calendars Extension - ignore empty string default values in events

- Fixed: JMAP Calendars Extension - do not use Participant.email for scheduling