Description of problem:

Claus Assmann from sendmail.org send a mail to sendmail-announce today containing the following message (the patch is not included, because it contains a link to it).

It would be helpful if the maintainers would release an updated package of sendmail which has the patch applied.

The bug is reported against Fedora 23, because I can only select one version. But I think it should be applied to all current version (22, 23, 24, rawhide).
sendmail-8.15.2-2.fc23.x86_64

Thanks in advance.

========

If sendmail tried to reuse an SMTP session which had already been
closed by the server, then the connection cache could have invalid
information about the session.  One possible consequence was that
STARTTLS was not used even if offered.
The problem can be fixed by either:
- applying the attached patch (for 8.15.2), also available at
  ftp://ftp.sendmail.org/pub/sendmail/8.15.2.mci.p0
  ftp://ftp.sendmail.org/pub/sendmail/8.15.2.mci.p0.sig
- or disabling the connection cache:
define(`confMCI_CACHE_SIZE', `0')

The problem can be mitigated by setting at least one of these options:
- using a very short timeout:
define(`confMCI_CACHE_TIMEOUT', `5s')
- sorting the queue by hosts:
define(`confQUEUE_SORT_ORDER', `Host')

To apply this patch, cd to the source code directory, then rebuild
and reinstall sendmail.

cd sendmail-8.15.2
patch  < 8.15.2.mci.p0

Note: This issue is fixed in sendmail snapshot 8.16.0.16 (or newer)
for those who would like to test upcoming releases.