From 8e4e9add78c6744057e9c4f5b80f4beb9f10f8cc Mon Sep 17 00:00:00 2001 From: Joshua Tauberer Date: Sun, 17 Dec 2023 16:29:30 -0500 Subject: [PATCH 1/3] Version 66 --- CHANGELOG.md | 6 ++++-- README.md | 2 +- setup/bootstrap.sh | 2 +- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a0f35d06..97642a01 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,10 +1,12 @@ CHANGELOG ========= -In Development --------------- +Version 66 (December 17, 2023) +------------------------------ * Some users reported an error installing Mail-in-a-Box related to the virtualenv command. This is hopefully fixed. +* Roundcube is updated to 1.6.5 fixing a security vulnerability. +* For Mail-in-a-Box developers, a new setup variable is added to pull the source code from a different repository. Version 65 (October 27, 2023) ----------------------------- diff --git a/README.md b/README.md index df387ab4..ac766ae8 100644 --- a/README.md +++ b/README.md @@ -60,7 +60,7 @@ Clone this repository and checkout the tag corresponding to the most recent rele $ git clone https://github.com/mail-in-a-box/mailinabox $ cd mailinabox - $ git checkout v65 + $ git checkout v66 Begin the installation. diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh index d3bd6fac..9399a235 100644 --- a/setup/bootstrap.sh +++ b/setup/bootstrap.sh @@ -23,7 +23,7 @@ if [ -z "$TAG" ]; then if [ "$UBUNTU_VERSION" == "Ubuntu 22.04 LTS" ]; then # This machine is running Ubuntu 22.04, which is supported by # Mail-in-a-Box versions 60 and later. - TAG=v65 + TAG=v66 elif [ "$UBUNTU_VERSION" == "Ubuntu 18.04 LTS" ]; then # This machine is running Ubuntu 18.04, which is supported by # Mail-in-a-Box versions 0.40 through 5x. From faf23f150c5fa85c8e9af1e345d796d2c36a4577 Mon Sep 17 00:00:00 2001 From: Joshua Tauberer Date: Fri, 22 Dec 2023 08:53:48 -0500 Subject: [PATCH 2/3] Guard against SMTP smuggling This short-term workaround is recommended at https://www.postfix.org/smtp-smuggling.html: smtpd_data_restrictions=reject_unauth_pipelining --- setup/mail-postfix.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/setup/mail-postfix.sh b/setup/mail-postfix.sh index 5787e8c9..de5dee0e 100755 --- a/setup/mail-postfix.sh +++ b/setup/mail-postfix.sh @@ -69,6 +69,11 @@ tools/editconf.py /etc/postfix/main.cf \ maximal_queue_lifetime=2d \ bounce_queue_lifetime=1d +# Guard against SMTP smuggling +# This short-term workaround is recommended at https://www.postfix.org/smtp-smuggling.html +tools/editconf.py /etc/postfix/main.cf \ + smtpd_data_restrictions=reject_unauth_pipelining + # ### Outgoing Mail # Enable the 'submission' ports 465 and 587 and tweak their settings. From 7646095b949e1c786f0742114ce35225898b47b1 Mon Sep 17 00:00:00 2001 From: Joshua Tauberer Date: Fri, 22 Dec 2023 08:56:27 -0500 Subject: [PATCH 3/3] v67 --- CHANGELOG.md | 5 +++++ README.md | 2 +- setup/bootstrap.sh | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 97642a01..c855c214 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,11 @@ CHANGELOG ========= +Version 67 (December 22, 2023) +------------------------------ + +* Guard against a newly published vulnerability called SMTP Smuggling. See https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/. + Version 66 (December 17, 2023) ------------------------------ diff --git a/README.md b/README.md index ac766ae8..8411c450 100644 --- a/README.md +++ b/README.md @@ -60,7 +60,7 @@ Clone this repository and checkout the tag corresponding to the most recent rele $ git clone https://github.com/mail-in-a-box/mailinabox $ cd mailinabox - $ git checkout v66 + $ git checkout v67 Begin the installation. diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh index 9399a235..b52848ee 100644 --- a/setup/bootstrap.sh +++ b/setup/bootstrap.sh @@ -23,7 +23,7 @@ if [ -z "$TAG" ]; then if [ "$UBUNTU_VERSION" == "Ubuntu 22.04 LTS" ]; then # This machine is running Ubuntu 22.04, which is supported by # Mail-in-a-Box versions 60 and later. - TAG=v66 + TAG=v67 elif [ "$UBUNTU_VERSION" == "Ubuntu 18.04 LTS" ]; then # This machine is running Ubuntu 18.04, which is supported by # Mail-in-a-Box versions 0.40 through 5x.