Dev November 2017

dev@lists.roundcube.net

3 participants
3 discussions

Attachment-Size
by Martin Wodrich 22 Nov '17

22 Nov '17

In our Roundcube (GIT-Master) Installation we can only attach up to 5 MebiByte Attachments. In the past (and in our 1.2.x RC-Installation) we can attach up to 128 MebiByte. We had already set the limits upload_max_filesize post_max_size memory_limit in the PHP.INI to 128M and comment out this in .htaccess. What can we do? Cheers, -- Martin Wodrich Admin freexp.de Waltrop/Germany

2 2

Roundcube Docker image
by Thomas Bruederli 21 Nov '17

21 Nov '17

Hello devs and list lurkers Upon common request [1] and a pull request from @J0WI we now published a Docker image for Roundcube webmail: https://hub.docker.com/r/roundcube/roundcubemail/ It's meant to be configured with the described env variables and ready for serving the webmail without first running through the installer. So far the configuration options are limited but it's a start. Before we now apply for an official image, I'd like your feedback and suggestions what other configuration options would be worth to be supported, especially when considering to use the docker image for production environments, too. So please give it a try and check the Dockerfile and entrypoint [2] for suggestions. Kind regards, Thomas [1] https://github.com/roundcube/roundcubemail/issues/5827 [2] https://github.com/roundcube/roundcubemail/tree/master/docker

1 0

Security updates 1.3.3, 1.2.7 and 1.1.10 released
by Thomas Bruederli 09 Nov '17

09 Nov '17

Dear subscribers We just published updates to all stable versions from 1.1.x onwards delivering fixes for a recently discovered file disclosure vulnerability in Roundcube Webmail. Apparently this zero-day exploit is already being used by hackers to read Roundcube’s configuration files. It requires a valid username/password as the exploit only works with a valid session. More details will be published soon under CVE-2017-16651. The Roundcube series 1.0.x is not affected by this vulnerability but we nevertheless back-ported the fix in order to protect from yet unknown exploits. See the full changelog for the according version in the release notes on the Github download pages: https://github.com/roundcube/roundcubemail/releases/tag/1.3.3 https://github.com/roundcube/roundcubemail/releases/tag/1.2.7 https://github.com/roundcube/roundcubemail/releases/tag/1.1.10 https://github.com/roundcube/roundcubemail/releases/tag/1.0.12 We strongly recommend to update all productive installations of Roundcube with either one of these versions. In order to check whether your Roundcube installation has been compromised check the access logs for requests like ?_task=settings&_action=upload-display&_from=timezone As mentioned above, the file disclosure only works for authenticated users and by finding such requests in the logs you should also be able to identify the account used for this unauthorized access. For mitigation we recommend to change the all credentials to external services like database or LDAP address books and preferably also the 'des_key' option in your config. Kind regards Alec & Thomas

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev November 2017