poste.io 2.5.10 → 2.5.15
5 releases · 0 breaking changes · 13 security fixes · 0 advisories fixed
13security0breaking0deprecated2feature9fix
Breaking changes
None in the release notes.
Security changes
- security security: add CSRF protection to state-changing log/dkim/filter/quarantine actions in 2.5.15
- security security: enforce log tenant scoping structurally, not via query string in 2.5.15
- security security: require current password for self-service password change in 2.5.15
- security security: sandbox BIMI logo SVG to prevent stored XSS in 2.5.15
- security security: enforce ownership check on box/domain quota endpoints in 2.5.15
- security Roundcube 1.6.17 in 2.5.14
- security Roundcube 1.6.16 in 2.5.13
- security security: fix SRS using a predictable secret (could allow SRS address forgery and mail relay) in 2.5.13
- security security: harden mailserver helpers against shell command injection in 2.5.13
- security fix #1198 add GID limits for Dovecot configuration in 2.5.12
- security fix Dovecot auth cache rollback in 2.5.12
- security Roundcube 1.6.15 in 2.5.11
- security fix Dovecot password caching, try no 2 in 2.5.11
Every release in between
otherremote monitoring: authenticated read-only health API and metrics
otherremote monitoring: optional outbound heartbeat posting
securitysecurity: add CSRF protection to state-changing log/dkim/filter/quarantine actions
securitysecurity: enforce log tenant scoping structurally, not via query string
securitysecurity: require current password for self-service password change
securitysecurity: sandbox BIMI logo SVG to prevent stored XSS
securitysecurity: enforce ownership check on box/domain quota endpoints
otherrate limit requests and block common scanner paths to prevent server overload
otheradvise to create virtual domain of hostname of mailserver and create DKIM
fixfix header_storage.js helper
fixfix admin bruteforce policy
fixfix daily cron noise about disabled mailboxes (doveadm -A now skips them)
fixfix Elasticsearch date handling in connection and transaction logs
feature"Do not log connections" moved from Advanced to the new Monitoring tab
securityRoundcube 1.6.17
featureadd option to keep a copy of outgoing mail in the Sent folder (per mailbox)
securityRoundcube 1.6.16
securitysecurity: fix SRS using a predictable secret (could allow SRS address forgery and mail relay)
securitysecurity: harden mailserver helpers against shell command injection
othermigrate Haraka to the @haraka/email-address library
otherimprove SRS for multi-hop forwarding: compact stateful addresses (RFC-5321 64-octet local-part compliance) and hop-by-hop bounce return
otherfaster startup detection in the container health check
fixfix #1190 add Sieve editheader extension
securityfix #1198 add GID limits for Dovecot configuration
fixfix #1199 Redis memory configuration via environment variables
fixfix SRS handling for multiple Sieve redirect headers
securityfix Dovecot auth cache rollback
fixfix rights of sensitive folders
securityRoundcube 1.6.15
fixfix login redirect when using passkey
securityfix Dovecot password caching, try no 2
otherraise limit for csv export