roundcube/roundcubemail 1.7.6

Roundcube Webmail 1.7.6

on GitHub

This is a security update to the version 1.7 of Roundcube Webmail.
It provides fixes to recently reported security vulnerabilities:

• Fix open redirect via IMAP error recovery on attachment get, reported by Santhoshkumar S.
• Fix so Received: header includes only trusted hostname and forwarded IP from a trusted proxy, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
• Fix bug where some managesieve destructive actions could have been triggered cross-site via GET, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
• Fix Sieve script injection via a rule operator, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
• Fix Sieve script injection via set/include modifiers, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
• Fix bug where resolve_url() ignored trusted host setting, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
• Fix mail header injection via a MDN subject, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5
• Fix HTTP request injection via the spellcheck ATD backend, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
• Fix IMAP command injection via CRLF in _uid parameter with messages_cache enabled, reported by dexx-tech.
• Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass, reported by blacksw0rd.
• Fix CSRF validation bypass for file-only POST requests, reported by skad00sh.
• Fix disabled_actions restriction bypass by writing '_' instead of '-' in the action name, reported by skad00sh.
• Fix CSRF validation bypass for mail purge/expunge commands, reported by threalwinky.
• Fix passing potentally unsafe attachment content into ImageMagick on image type conversion, reported by José Luis Sánchez Pérez - Cybersecurity Blue & Red Team.
• Fix Unbounded CPU loop/DoS in rcube_session::unserialize() via a negative length token, reported by Guang.
• Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses, reported by wyx98765.
• Fix so IMAP host input is validated more strictly, reported by Mohamed Elgzouli.

This version is considered stable and we recommend to update all productive installations of Roundcube with it. Please do backup your data before updating!

CHANGELOG

• Enable PHP 8.6 support (#10368, #10362)
• LDAP: Fix TypeError on group members listing with PHP 8 (#10364)
• Fix/Improve handling of IMAP literal strings
• Fix fatal error when a SORT/THREAD/SEARCH/ESEARCH command response includes untagged responses (#10361)
• Fix TypeError when archiving all messages via select-all (#10107)
• Fix temporary files permissions to 0600 (#10328)
• Fix refresh interval setting showing "never" when the configured value is not one of the predefined intervals (#10292)
• Fix installto.sh and update.sh reporting success when an upgrade step fails (#10326)
• Newmail_notifier: Fix restoring skin favicons defined with rel="icon" (#9575)
• LDAP: Fix website link including the labeledURI label (#8816)
• Fix non-ASCII special folder names displayed in UTF7-IMAP encoding when real names are shown (#10375)
• Security: Fix open redirect via IMAP error recovery on attachment get
• Security: Fix so Received: header includes only trusted hostname and forwarded IP from a trusted proxy
• Security: Fix bug where some managesieve destructive actions could have been triggered cross-site via GET
• Security: Fix Sieve script injection via a rule operator
• Security: Fix Sieve script injection via set/include modifiers
• Security: Fix bug where resolve_url() ignored trusted host setting
• Security: Fix mail header injection via a MDN subject
• Security: Fix HTTP request injection via the spellcheck ATD backend
• Security: Fix IMAP command injection via CRLF in _uid parameter with messages_cache enabled
• Security: Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass
• Security: Fix CSRF validation bypass for file-only POST requests
• Security: Fix disabled_actions restriction bypass by writing '_' instead of '-' in the action name
• Security: Fix CSRF validation bypass for mail purge/expunge commands
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image type conversion
• Security: Fix Unbounded CPU loop/DoS in rcube_session::unserialize() via a negative length token
• Security: Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses
• Security: Fix so IMAP host input is validated more strictly