Mailu 2024.06.50 → 2024.06.65
15 releases · 0 breaking changes · 4 security fixes · 4 advisories fixed
4security0breaking0deprecated0feature6fix
Vulnerabilities fixed by this upgrade
- 5.3 GHSA-h3q9-vqhp-pc9x Rate limiting bypass
- 7.5 CVE-2024-49767 DoS vector
- 9.3 GHSA-7mff-qrqm-v4q7 XSS on /Autodiscover/Autodiscover.xml
- 9.8 CVE-2026-85751 Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust
Breaking changes
None in the release notes.
Security changes
- security Fixes GHSA-h3q9-vqhp-pc9x: Rate limiting bypass in 2024.06.58
- security roundcube 1.6.17 - fix multiple CVEs: CVE-2026-54432 CVE-2026-54433 in 2024.06.56
- security Ensure we set X-Forwarded-By, see GHSA-rfhj-4wcq-74xg in 2024.06.55
- security Fix CVE-2026-49217 in 2024.06.52
Every release in between
otherRoundcube 1.6.20
otherThis release was triggered by PR/Issue 4141.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherMake the resolver healthcheck fail when unbound answers SERVFAIL, instead of reporting healthy while every lookup fails
otherThis release was triggered by PR/Issue 4124.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherMake the resolver healthcheck fail when unbound answers SERVFAIL, instead of reporting healthy while every lookup fails
otherThis release was triggered by PR/Issue 4124.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherDeal with the KSK rollover, ensure it does not happen again.
otherThis release was triggered by PR/Issue 4118.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherClear stale webmail session cookies on SSO login, so switching accounts without logging out no longer leaves the webmail on the previous user (AUTHENTICATIONFAILED folders error)
otherThis release was triggered by PR/Issue 4109.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
fixFix three boolean settings that could not be turned off. Each reached a jinja template through os.environ, where every value is a string -- and "False" is a non-empty string, which jinja reads as true. DEFER_ON_TLS_ERROR=False left smtp_tls_dane_insecure_mx_policy at dane and strict_testing at…
otherThis release was triggered by PR/Issue 4103.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
fixFix "Please don't turn CURLOPT_SSL_VERIFYCLIENT off" on modern roundcube Upgrade to roundcube 1.6.18
otherThis release was triggered by PR/Issue 4034.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
securityFixes GHSA-h3q9-vqhp-pc9x: Rate limiting bypass
fixFix "Please don't turn CURLOPT_SSL_VERIFYCLIENT off" on modern roundcube Upgrade to roundcube 1.6.18
otherThis release was triggered by PR/Issue 4034.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
fixFix autoconfig on modern k9-mail
otherThis release was triggered by PR/Issue 4075.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
securityroundcube 1.6.17 - fix multiple CVEs: CVE-2026-54432 CVE-2026-54433
otherThis release was triggered by PR/Issue 4073.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
securityEnsure we set X-Forwarded-By, see GHSA-rfhj-4wcq-74xg
otherThis release was triggered by PR/Issue 4070.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
fixFix two admin-UI form-flow bugs: the forced password change now redirects to the chosen destination instead of always the admin UI, and the Create User form keeps the entered values and validation errors on a failed submit.
otherThis release was triggered by PR/Issue 4060.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
fixFix automatic replies (vacation) failing to compile when the account display name contains special characters such as @; the sieve :from now uses a quoted RFC 5322 display name, and all user-controlled fields rendered into the script are escaped (\, ", $) to prevent sieve injection.
otherThis release was triggered by PR/Issue 3983.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherUpgrade roundcube to 1.6.16 and carddav to 5.1.3
securityFix CVE-2026-49217
otherThis release was triggered by PR/Issue 4030.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherUpgrade alpine to 3.20.10
otherThis release was triggered by PR/Issue 4018.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.