Roundcube’s October Fixes Reach Beyond the Login Page
Roundcube’s October security update reaches into the way webmail handles messages, attachments, account identities and server requests. Treating it as a login-page patch misses the routes that process untrusted mail after it has arrived.
The project’s 19 October announcement recommends updating production installations of the 1.6 LTS and 1.7 branches to 1.6.20 and 1.7.5 respectively. Both releases list the same 20 security entries. That is a list of corrections across several boundaries, not evidence that every installation exposes every path or that the entries all have assigned vulnerability identifiers.
Mail fields must remain data
Two fixes concern carriage-return and line-feed handling in IMAP actions: the _uid parameter used when viewing headers or message source, and the _flag parameter used to mark messages. These are separate application inputs crossing into commands sent to the mail server. A normal successful mailbox login does not exercise either boundary.
Other entries address injection into generated mail headers. They cover a sender’s display name during Bounce or resend, References, In-Reply-To, Message-ID and From parameters, the subject of a message forwarded as an attachment, and the media type supplied in an inline-image data URI. Review these as distinct message-construction paths rather than assuming that checking the ordinary compose window covers all of them.
Blocking remote content needs more than a checkbox
The release also corrects a server-side request-forgery filter bypass involving the NAT64 64:ff9b::/96 address range. Its remote-content corrections address an SVG SMIL by attribute and CSS escapes in FuncIRI attributes. A further fix prevents CSS at-rules from escaping the intended scope inside HTML messages.
Those entries concern different decisions: which destination the server may contact, which remote content a message may load, and where message styling may take effect. BlackTree recommends checking the relevant controls in an authorised test environment after deployment, while keeping the test results separate from the fact that an update was installed.
Resource and attachment processing need attention too. Roundcube adds a size limit when processing content through its CSS proxy, changes the handling of potentially unsafe attachment content passed to ImageMagick during resizing, and fixes a path where fallback to GD bypassed ImageMagick resource limits. An image-preview feature still processes outside input even when users do not download an attachment.
Account and action controls have their own corrections
The remaining security entries span alias logins that were not qualified by IMAP host, an object-injection primitive involving exclamation-prefixed session keys in rcube_session::unserialize(), and deprecated action aliases that bypassed disabled_actions. They also include a cross-site request-forgery check bypass in mark-as-junk, cross-site scripting in password-driver error responses, a Password Modoboa driver path that could change another account’s password, and unsafe use of a login name in a SquirrelMail import file path.
These descriptions identify the affected components without establishing one universal authentication requirement, exploit chain or incident. Inventory the password drivers, import features and disabled actions actually configured in each deployment. A feature that is absent in one installation does not establish the exposure of a different configuration.
Separate the two release lines and the earlier incident
The full release notes for 1.6.20 and 1.7.5 are dated 19 October. The 1.7.5 changelog additionally covers installer-session and cookie cleanup, restoration of Enigma keyring files, Markasjunk handling of values beginning with a hyphen, single-pass replacement of Password SQL placeholders and the health-check script’s exit code. These additional entries should not automatically be described as five separately assigned vulnerabilities.
Our earlier Roundcube report concerns the May SQL-injection correction and a September warning of exploitation. That is a different development. Its exploitation evidence cannot be carried across to this October release, whose announcement and release notes do not report exploitation of these newly listed issues.
Confirm the running application, then the controls
Roundcube asks operators to back up their data before updating. Identify each directly hosted, provider-managed and recovery installation, preserve the existing configuration and follow the appropriate release-line procedure. For a distribution or hosting-panel package, check the supplier’s actual package and correction evidence rather than judging only by an upstream version string.
After maintenance, confirm which application is running and check the configured paths that matter: message-source and flag operations, resend and forwarded attachments, remote-content blocking, previews, junk handling and password changes. Keep an accountable record of the result and investigate suspicious earlier activity separately. A completed upgrade is evidence of maintenance; it cannot establish that no earlier misuse occurred.
