Hestia Panel 1.9.5 Service Release: Security Fixes and CVE Mitigations

Vulnerability Overview Vulnerability Name: 1.9.5 Service Release Release Date: May 28, 2023 Publisher: jaapmarcus Scope of Impact PHP 8.4 Support: Quick Install apps Security and Performance Optimizations: Multiple areas Bug Fixes: - Cleaned up argument handling and improved KV parsing - Fixed 421 errors for all web and mail domains after the Apache 2.4.64 update - Set SOA retry value to 1800 for DENIC compliance - Fixed domain alias replacement logic when changing web domains - Fixed ipv4_cidr validation - Updated magento.tpl/magento.stpl to support health checks - Added display of user and bandwidth quotas in the dashboard - Sorted backup file lists before retention checks - Improved logging for Spamhaus DQS lookups to prevent query key exposure - Upgraded Roundcube to version 1.6.11 - Removed the apache2-suevec-pristine package from the Debian installer - Fixed non-pending domain redirections - Ensured a newline is added to the end of the hestiaweb user crontab - Allowed slashes when adding usernames to the SMTP relay - Prevented empty user variables from affecting multiple scripts - Fixed Panel Ciphers for hestiamail - Fixed missing proftpd-mod-crypto dependency on Ubuntu - Fixed the certificate chain verification method for Hestia - Changed the class in the latest version of the File Manager Remediation Specific Remediation Measures: - Cleaned up argument handling and improved KV parsing - Fixed 421 errors for all web and mail domains after the Apache 2.4.64 update - Set SOA retry value to 1800 for DENIC compliance - Fixed domain alias replacement logic when changing web domains - Fixed ipv4_cidr validation - Updated magento.tpl/magento.stpl to support health checks - Added display of user and bandwidth quotas in the dashboard - Sorted backup file lists before retention checks - Improved logging for Spamhaus DQS lookups to prevent query key exposure - Upgraded Roundcube to version 1.6.11 - Removed the apache2-suevec-pristine package from the Debian installer - Fixed non-pending domain redirections - Ensured a newline is added to the end of the hestiaweb user crontab - Allowed slashes when adding usernames to the SMTP relay - Prevented empty user variables from affecting multiple scripts - Fixed Panel Ciphers for hestiamail - Fixed missing proftpd-mod-crypto dependency on Ubuntu - Fixed the certificate chain verification method for Hestia - Changed the class in the latest version of the File Manager POC Code or Exploit Code No POC code or exploit code available Summary Main Updates: The 1.9.5 Service Release includes multiple security and performance optimizations, as well as various bug fixes. These cover PHP 8.4 support, Apache 2.4.64 updates, DENIC compliance, domain alias replacement logic, ipv4_cidr validation, magento.tpl/magento.stpl updates, display of user and bandwidth quotas, sorting of backup file lists, logging for Spamhaus DQS lookups, Roundcube upgrade, removal of the Debian installer package, domain redirection, hestiaweb user crontab handling, SMTP relay configuration, user variables, Panel Ciphers, proftpd-mod-crypto dependency, Hestia certificate verification, and File Manager class changes.

Goal Reached Thanks to every supporter — we hit 100%!

Hestia Panel 1.9.5 Service Release: Security Fixes and CVE Mitigations

More from this source