Mailu 2024.06.58 → 2024.06.67
9 releases · 0 breaking changes · 2 security fixes · 2 advisories fixed
2security0breaking0deprecated0feature2fix
Vulnerabilities fixed by this upgrade
- 7.5 CVE-2024-49767 DoS vector
- 9.3 GHSA-7mff-qrqm-v4q7 XSS on /Autodiscover/Autodiscover.xml
Breaking changes
None in the release notes.
Security changes
- security Mitigate known PHP2Shell attack paths (CVE-2026-109618 and CVE-2026-109619) in webmail with a patched PHP runtime. in 2024.06.67
- security Mitigate known PHP2Shell attack paths (CVE-2026-109618 and CVE-2026-109619) in webmail pending a patched PHP runtime. in 2024.06.66
Every release in between
securityMitigate known PHP2Shell attack paths (CVE-2026-109618 and CVE-2026-109619) in webmail with a patched PHP runtime.
otherThis release was triggered by PR/Issue 4143.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
securityMitigate known PHP2Shell attack paths (CVE-2026-109618 and CVE-2026-109619) in webmail pending a patched PHP runtime.
otherThis release was triggered by PR/Issue 4143.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherRoundcube 1.6.20
otherThis release was triggered by PR/Issue 4141.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherMake the resolver healthcheck fail when unbound answers SERVFAIL, instead of reporting healthy while every lookup fails
otherThis release was triggered by PR/Issue 4124.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherMake the resolver healthcheck fail when unbound answers SERVFAIL, instead of reporting healthy while every lookup fails
otherThis release was triggered by PR/Issue 4124.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherDeal with the KSK rollover, ensure it does not happen again.
otherThis release was triggered by PR/Issue 4118.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherClear stale webmail session cookies on SSO login, so switching accounts without logging out no longer leaves the webmail on the previous user (AUTHENTICATIONFAILED folders error)
otherThis release was triggered by PR/Issue 4109.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
fixFix three boolean settings that could not be turned off. Each reached a jinja template through os.environ, where every value is a string -- and "False" is a non-empty string, which jinja reads as true. DEFER_ON_TLS_ERROR=False left smtp_tls_dane_insecure_mx_policy at dane and strict_testing at…
otherThis release was triggered by PR/Issue 4103.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
fixFix "Please don't turn CURLOPT_SSL_VERIFYCLIENT off" on modern roundcube Upgrade to roundcube 1.6.18
otherThis release was triggered by PR/Issue 4034.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.