Roundcube 1.7.5 → 1.7.6
1 release · 0 breaking changes · 21 security fixes · 0 advisories fixed
21security0breaking0deprecated0feature19fix
Breaking changes
None in the release notes.
Security changes
- security Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass, reported by blacksw0rd. in 1.7.6
- security Fix CSRF validation bypass for file-only POST requests, reported by skad00sh. in 1.7.6
- security Fix CSRF validation bypass for mail purge/expunge commands, reported by threalwinky. in 1.7.6
- security Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses, reported by wyx98765. in 1.7.6
- security Security: Fix open redirect via IMAP error recovery on attachment get in 1.7.6
- security Security: Fix so Received: header includes only trusted hostname and forwarded IP from a trusted proxy in 1.7.6
- security Security: Fix bug where some managesieve destructive actions could have been triggered cross-site via GET in 1.7.6
- security Security: Fix Sieve script injection via a rule operator in 1.7.6
- security Security: Fix Sieve script injection via set/include modifiers in 1.7.6
- security Security: Fix bug where resolve_url() ignored trusted host setting in 1.7.6
- security Security: Fix mail header injection via a MDN subject in 1.7.6
- security Security: Fix HTTP request injection via the spellcheck ATD backend in 1.7.6
- security Security: Fix IMAP command injection via CRLF in _uid parameter with messages_cache enabled in 1.7.6
- security Security: Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass in 1.7.6
- security Security: Fix CSRF validation bypass for file-only POST requests in 1.7.6
- security Security: Fix disabled_actions restriction bypass by writing '_' instead of '-' in the action name in 1.7.6
- security Security: Fix CSRF validation bypass for mail purge/expunge commands in 1.7.6
- security Security: Fix passing potentally unsafe attachment content into ImageMagick on image type conversion in 1.7.6
- security Security: Fix Unbounded CPU loop/DoS in rcube_session::unserialize() via a negative length token in 1.7.6
- security Security: Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses in 1.7.6
- security Security: Fix so IMAP host input is validated more strictly in 1.7.6
Every release in between
fixFix open redirect via IMAP error recovery on attachment get, reported by Santhoshkumar S.
fixFix so Received: header includes only trusted hostname and forwarded IP from a trusted proxy, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
fixFix bug where some managesieve destructive actions could have been triggered cross-site via GET, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
fixFix Sieve script injection via a rule operator, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
fixFix Sieve script injection via set/include modifiers, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
fixFix bug where resolve_url() ignored trusted host setting, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
fixFix mail header injection via a MDN subject, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5
fixFix HTTP request injection via the spellcheck ATD backend, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
fixFix IMAP command injection via CRLF in _uid parameter with messages_cache enabled, reported by dexx-tech.
securityFix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass, reported by blacksw0rd.
securityFix CSRF validation bypass for file-only POST requests, reported by skad00sh.
fixFix disabled_actions restriction bypass by writing '_' instead of '-' in the action name, reported by skad00sh.
securityFix CSRF validation bypass for mail purge/expunge commands, reported by threalwinky.
fixFix passing potentally unsafe attachment content into ImageMagick on image type conversion, reported by José Luis Sánchez Pérez - Cybersecurity Blue & Red Team.
fixFix Unbounded CPU loop/DoS in rcube_session::unserialize() via a negative length token, reported by Guang.
securityFix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses, reported by wyx98765.
fixFix so IMAP host input is validated more strictly, reported by Mohamed Elgzouli.
fixLDAP: Fix TypeError on group members listing with PHP 8 (#10364)
fixFix/Improve handling of IMAP literal strings
fixFix fatal error when a SORT/THREAD/SEARCH/ESEARCH command response includes untagged responses (#10361)
fixFix TypeError when archiving all messages via select-all (#10107)
fixFix temporary files permissions to 0600 (#10328)
fixFix refresh interval setting showing "never" when the configured value is not one of the predefined intervals (#10292)
securitySecurity: Fix open redirect via IMAP error recovery on attachment get
securitySecurity: Fix so Received: header includes only trusted hostname and forwarded IP from a trusted proxy
securitySecurity: Fix bug where some managesieve destructive actions could have been triggered cross-site via GET
securitySecurity: Fix Sieve script injection via a rule operator
securitySecurity: Fix Sieve script injection via set/include modifiers
securitySecurity: Fix bug where resolve_url() ignored trusted host setting
securitySecurity: Fix mail header injection via a MDN subject
securitySecurity: Fix HTTP request injection via the spellcheck ATD backend
securitySecurity: Fix IMAP command injection via CRLF in _uid parameter with messages_cache enabled
securitySecurity: Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass
securitySecurity: Fix CSRF validation bypass for file-only POST requests
securitySecurity: Fix disabled_actions restriction bypass by writing '_' instead of '-' in the action name
securitySecurity: Fix CSRF validation bypass for mail purge/expunge commands
securitySecurity: Fix passing potentally unsafe attachment content into ImageMagick on image type conversion
securitySecurity: Fix Unbounded CPU loop/DoS in rcube_session::unserialize() via a negative length token
securitySecurity: Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses
securitySecurity: Fix so IMAP host input is validated more strictly
+5 more items in the release notes