This is a security update to the version 1.6 of Roundcube Webmail.
It provides fixes to recently reported security vulnerabilities:
- Fix open redirect via IMAP error recovery on attachment get, reported by Santhoshkumar S.
- Fix so Received: header includes only trusted hostname and forwarded IP from a trusted proxy, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
- Fix bug where some managesieve destructive actions could have been triggered cross-site via GET, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
- Fix Sieve script injection via a rule operator, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
- Fix Sieve script injection via set/include modifiers, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
- Fix bug where resolve_url() ignored trusted host setting, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
- Fix mail header injection via a MDN subject, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5
- Fix HTTP request injection via the spellcheck ATD backend, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
- Fix IMAP command injection via CRLF in _uid parameter with messages_cache enabled, reported by dexx-tech.
- Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass, reported by blacksw0rd.
- Fix CSRF validation bypass for file-only POST requests, reported by skad00sh.
- Fix
disabled_actionsrestriction bypass by writing '_' instead of '-' in the action name, reported by skad00sh. - Fix CSRF validation bypass for mail purge/expunge commands, reported by threalwinky.
- Fix passing potentally unsafe attachment content into ImageMagick on image type conversion, reported by José Luis Sánchez Pérez - Cybersecurity Blue & Red Team.
- Fix Unbounded CPU loop/DoS in rcube_session::unserialize() via a negative length token, reported by Guang.
- Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses, reported by wyx98765.
- Fix so IMAP host input is validated more strictly, reported by Mohamed Elgzouli.
This version is considered stable and we recommend to update all productive installations of Roundcube with it. Please do backup your data before updating!
WARNING: The 1.6 branch is four years old. Please, plan your upgrade to 1.7 soon. Backporting security patches became increasingly hard, annoying and error prone. 1.6 will be discontinued rather soon.
CHANGELOG
- Security: Fix open redirect via IMAP error recovery on attachment get
- Security: Fix so Received: header includes only trusted hostname and forwarded IP from a trusted proxy
- Security: Fix bug where some managesieve destructive actions could have been triggered cross-site via GET
- Security: Fix Sieve script injection via a rule operator
- Security: Fix Sieve script injection via set/include modifiers
- Security: Fix bug where resolve_url() ignored trusted host setting
- Security: Fix mail header injection via a MDN subject
- Security: Fix HTTP request injection via the spellcheck ATD backend
- Security: Fix IMAP command injection via CRLF in _uid parameter with messages_cache enabled
- Security: Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass
- Security: Fix CSRF validation bypass for file-only POST requests
- Security: Fix
disabled_actionsrestriction bypass by writing '_' instead of '-' in the action name - Security: Fix CSRF validation bypass for mail purge/expunge commands
- Security: Fix passing potentally unsafe attachment content into ImageMagick on image type conversion
- Security: Fix Unbounded CPU loop/DoS in rcube_session::unserialize() via a negative length token
- Security: Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses
- Security: Fix so IMAP host input is validated more strictly