Starstruk Logo MarkStarstruk

2024-04

mailcow/mailcow-dockerized2024-04Apr 4, 2024by FreddleSpl0it

AI Summary

A security-focused update addressing two critical vulnerabilities (XSS and Path Traversal) and upgrading the SOGo webmail client.

Key Highlights

  • Fixed CVE-2024-31204 (XSS Vulnerability via Exception Handler)
  • Fixed CVE-2024-30270 (Path Traversal and Arbitrary Code Execution)
  • Upgraded SOGo to version 5.10.0
  • Updated Postfix and Rspamd rules

Full Release Notes

## What's Changed
With the Moopril update, two security vulnerabilities in mailcow will be closed.
1. CVE-2024-31204: XSS Vulnerability via Exception Handler
2. CVE-2024-30270: Path Traversal and Arbitrary Code Execution Vulnerability

Thanks to [Paul Gerste](https://github.com/paul-gerste-sonarsource) from [Sonar](https://www.sonarsource.com/) for reporting the security vulnerabilities!

* chore(deps): update thollander/actions-comment-pull-request action to v2.5.0 by @renovate in https://github.com/mailcow/mailcow-dockerized/pull/5747
* Translations update from Weblate by @milkmaker in https://github.com/mailcow/mailcow-dockerized/pull/5762
* sogo: upgrade to 5.10.0 by @DerLinkman in https://github.com/mailcow/mailcow-dockerized/pull/5765
* Translations update from Weblate by @milkmaker in https://github.com/mailcow/mailcow-dockerized/pull/5777
* [Web]Small change about zh-cn translation by @aaadddfgh in https://github.com/mailcow/mailcow-dockerized/pull/5789
* [Postfix] update postscreen_access.cidr by @milkmaker in https://github.com/mailcow/mailcow-dockerized/pull/5770
* Remove one GmbH in Dockerfiles by @MAGICCC in https://github.com/mailcow/mailcow-dockerized/pull/5743
* Translations update from Weblate by @milkmaker in https://github.com/mailcow/mailcow-dockerized/pull/5810
* Update French translation by @yvan-algoo in https://github.com/mailcow/mailcow-dockerized/pull/5805
* Translations update from Weblate by @milkmaker in https://github.com/mailcow/mailcow-dockerized/pull/5813
* [Postfix] update postscreen_access.cidr by @milkmaker in https://github.com/mailcow/mailcow-dockerized/pull/5811
* Translations update from Weblate by @milkmaker in https://github.com/mailcow/mailcow-dockerized/pull/5815
* [Rspamd] Set local_addrs lo mailcow networks by @dragoangel in https://github.com/mailcow/mailcow-dockerized/pull/5812
* [Rspamd] milter update Content-Type and Content-Transfer-Encoding header by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/5751
* [Web] fix exception handler and rspamd_maps function by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/5818

## New Contributors
* @aaadddfgh made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/5789

**Full Changelog**: https://github.com/mailcow/mailcow-dockerized/compare/2024-02...2024-04