Mailu 2024.06.54 → 2024.06.67
13 releases · 0 breaking changes · 5 security fixes · 4 advisories fixed
5security0breaking0deprecated0feature4fix
Vulnerabilities fixed by this upgrade
- 5.3 GHSA-h3q9-vqhp-pc9x Rate limiting bypass
- 7.5 CVE-2024-49767 DoS vector
- 9.3 GHSA-7mff-qrqm-v4q7 XSS on /Autodiscover/Autodiscover.xml
- 9.8 CVE-2026-85751 Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust
Breaking changes
None in the release notes.
Security changes
- security Mitigate known PHP2Shell attack paths (CVE-2026-109618 and CVE-2026-109619) in webmail with a patched PHP runtime. in 2024.06.67
- security Mitigate known PHP2Shell attack paths (CVE-2026-109618 and CVE-2026-109619) in webmail pending a patched PHP runtime. in 2024.06.66
- security Fixes GHSA-h3q9-vqhp-pc9x: Rate limiting bypass in 2024.06.58
- security roundcube 1.6.17 - fix multiple CVEs: CVE-2026-54432 CVE-2026-54433 in 2024.06.56
- security Ensure we set X-Forwarded-By, see GHSA-rfhj-4wcq-74xg in 2024.06.55
Every release in between
securityMitigate known PHP2Shell attack paths (CVE-2026-109618 and CVE-2026-109619) in webmail with a patched PHP runtime.
otherThis release was triggered by PR/Issue 4143.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
securityMitigate known PHP2Shell attack paths (CVE-2026-109618 and CVE-2026-109619) in webmail pending a patched PHP runtime.
otherThis release was triggered by PR/Issue 4143.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherRoundcube 1.6.20
otherThis release was triggered by PR/Issue 4141.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherMake the resolver healthcheck fail when unbound answers SERVFAIL, instead of reporting healthy while every lookup fails
otherThis release was triggered by PR/Issue 4124.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherMake the resolver healthcheck fail when unbound answers SERVFAIL, instead of reporting healthy while every lookup fails
otherThis release was triggered by PR/Issue 4124.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherDeal with the KSK rollover, ensure it does not happen again.
otherThis release was triggered by PR/Issue 4118.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherClear stale webmail session cookies on SSO login, so switching accounts without logging out no longer leaves the webmail on the previous user (AUTHENTICATIONFAILED folders error)
otherThis release was triggered by PR/Issue 4109.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
fixFix three boolean settings that could not be turned off. Each reached a jinja template through os.environ, where every value is a string -- and "False" is a non-empty string, which jinja reads as true. DEFER_ON_TLS_ERROR=False left smtp_tls_dane_insecure_mx_policy at dane and strict_testing at…
otherThis release was triggered by PR/Issue 4103.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
fixFix "Please don't turn CURLOPT_SSL_VERIFYCLIENT off" on modern roundcube Upgrade to roundcube 1.6.18
otherThis release was triggered by PR/Issue 4034.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
securityFixes GHSA-h3q9-vqhp-pc9x: Rate limiting bypass
fixFix "Please don't turn CURLOPT_SSL_VERIFYCLIENT off" on modern roundcube Upgrade to roundcube 1.6.18
otherThis release was triggered by PR/Issue 4034.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
fixFix autoconfig on modern k9-mail
otherThis release was triggered by PR/Issue 4075.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
securityroundcube 1.6.17 - fix multiple CVEs: CVE-2026-54432 CVE-2026-54433
otherThis release was triggered by PR/Issue 4073.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
securityEnsure we set X-Forwarded-By, see GHSA-rfhj-4wcq-74xg
otherThis release was triggered by PR/Issue 4070.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.