Roundcube 1.7.2 Security Update Fixes SSRF/XSS/DoS

Vulnerability Overview Roundcube Webmail 1.7.2 is a security update that addresses multiple reported vulnerabilities. These include infinite loops, various vulnerabilities in the password plugin, stored XSS, SSRF bypasses, zero-click stored XSS, and DoS attacks. Impact Scope Infinite Loop: An infinite loop exists in the TNEF (winmail.dat) decoder. Password Plugin Vulnerabilities: Multiple vulnerabilities exist when using session-injected usernames. Stored XSS: Stored XSS occurs on the attachment validation warning page via unescaped attachment MIME types. SSRF Bypass: SSRF bypass is possible via specific local address URLs. Zero-Click Stored XSS: Zero-click stored XSS exists in plain-text rendering. DoS Attack: A DoS attack is possible via crafted compressed RTF sizes in TNEF (winmail.dat) files. Remediation Infinite Loop: Fixed the infinite loop in the TNEF (winmail.dat) decoder. Password Plugin Vulnerabilities: Fixed multiple vulnerabilities related to the use of session-injected usernames. Stored XSS: Fixed stored XSS on the attachment validation warning page caused by unescaped attachment MIME types. SSRF Bypass: Fixed SSRF bypasses via specific local address URLs. Zero-Click Stored XSS: Fixed zero-click stored XSS in plain-text rendering. DoS Attack: Fixed DoS attacks caused by crafted compressed RTF sizes in TNEF (winmail.dat) files. Additional Information Version Stability: This version is considered stable. It is recommended to update all Roundcube installations in production environments. Data Backup: Please back up your data before updating. Detailed Fix Content Add HEAD request handler to static.php Fix so the oauth_password_claim claim is retrieved via token or userinfo request Fix bug where static.php would return a 416 error on a specific Range request Fix bug where configured skin logo wasn't loaded via static.php resulting in a 404 error Fix bug where install.sh would fail if the public_html folder does not exist in the target directory Revert "Prefer 8bit over quoted-printable for HTML parts, when force_8bit is disabled" Fix incorrect unfolding of folded lines when importing vCard 2.1 contacts Fix bug where Imagick could leave large temporary files on failure Fix bug where redis/memcache sessions could have been updated more often than necessary Fix support for untyped tokens in OIDC backchannel logout, require unset nonce Security: Fix an infinite loop in the TNEF (winmail.dat) decoder Security: Fix various vulnerabilities in the password plugin using session-injected usernames Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page Security: Fix SSRF bypass via specific local address URLs - two new cases Security: Fix zero-click stored XSS in plain-text rendering Security: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file Summary Roundcube Webmail version 1.7.2 fixes multiple severe security vulnerabilities, including infinite loops, stored XSS, SSRF bypasses, zero-click stored XSS, and DoS attacks. It is recommended that all Roundcube installations in production environments update to this version immediately, and to back up data before the update.

Goal Reached Thanks to every supporter — we hit 100%!

Roundcube 1.7.2 Security Update Fixes SSRF/XSS/DoS

More from this source