Resolved Roundcube 1.6.4 is released. When will plesk upgrade to it?

[dlabsnl]

Hello,
Roundcube 1.6.4 is released to provide a fix see below.

Roundcube Webmail 1.6.4 Latest
This is a security update to the stable version 1.6 of Roundcube Webmail.
It provides a fix to a recently reported XSS vulnerability:

• Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168) reported separately by Matthieu Faou (ESET) and Denys Klymenko.

This version is considered stable and we recommend to update all productive installations of Roundcube 1.6.x with it. Please do backup your data before updating!

When can we expect an update for it?

 

[scsa20]

Generally those kind of updates are done by your OS package manager. You can read more about the lifecycle policy over at Plesk Lifecycle Policy

 

[Peter Debik]

Hmm, well, for Plesk maybe not. It was only 12 days ago that we updated to Roundcube 1.6.3. I have no ETA yet for an update to 1.6.4.

 

[Mark_NLD]

@Peter Debik this Roundcube update is urgently needed. Can you escalate this internally? I will also open a ticket tomorrow.

Please also see:

Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers

ESET Research discover campaigns by the Winter Vivern APT group that exploit a zero-day XSS vulnerability in the Roundcube Webmail server and target governmental entities and a think tank in Europe.

www.welivesecurity.com

 

[Peter Debik]

Plesk has plans to upgrade Roundcube to 1.6.4 and - where applicable due to operating system limits - 1.4.15 in the next release which will probably be published in the middle of November.

 

[danami]

Plesk has plans to upgrade Roundcube to 1.6.4 and - where applicable due to operating system limits - 1.4.15 in the next release which will probably be published in the middle of November.

Wow that was quick. Looks like it's already being actively exploited:

Pro-Russia hackers target inboxes with 0-day in webmail app used by millions

Previously unknown XSS in Roundcube let Winter Vivern steal government emails.

arstechnica.com

 

[S. Schröder]

Mid-November?

This is a security vulnerability that is already being exploited!

What's wrong with you?

You should fix / roll this out in a few hours!

With little understanding
Stephan Schröder

 

[Mark_NLD]

Plesk has plans to upgrade Roundcube to 1.6.4 and - where applicable due to operating system limits - 1.4.15 in the next release which will probably be published in the middle of November.

That is better then I initially expected but since we are seeing active exploits mid November is not good enough. I'll raise a ticket now to increase urgency.

 

[Mark_NLD]

This thread should be merged with Issue - Plesk Rouncube and exploit CVE-2023-5631

 

[danami]

I'm surprised how fast an exploit can make the front page of Arstechnica Plesk is very quick at patching CVEs. I'm sure they are aware of the issue now that it's made front page of the tech news sites.

 

[Peter Debik]

This thread should be merged with Issue - Plesk Rouncube and exploit CVE-2023-5631

It's technically not possible with the forum software.

 

[Peter Debik]

We're currently planning to deliver the fix with a micro update 18.0.56 #2, which will be published sooner than the next regular update.

 

[Peter Debik]

https://support.plesk.com/hc/en-us/articles/18573638599831-CVE-2023-5631-vulnerability-in-Roundcube

 

[Mark_NLD]

Thanks for the great updates @Peter Debik

 

[470rent]

I've been using Horde because of this vulnerability and subsequent exploit. It'll be good to get back onto roundcube.

 

[AYamshanov]

I've been using Horde because of this vulnerability and subsequent exploit. It'll be good to get back onto roundcube.

Yes, it is kind of a temporary workaround till the security update be available.

I also would like to suggest everyone to give a try SOGo Webmail if you do not have dependencies or requirements to use exactly Roundcube.

 

[Maarten.]

The Roundcube update is available in 18.0.56#2.
Install it via: Tools & Settings -> Updates

Change Log for Plesk Obsidian

Find out about changes, additions and updates to Plesk Obsidian on an iteration to iteration basis.

docs.plesk.com

Plesk Obsidian 18.0.56 Update 2​

Changes in Third-Party Components​

Linux

• Updated Roundcube to version 1.6.4.
• Updated Roundcube to version 1.4.15.

 

[470rent]

Nice, thank you for getting it resolved ahead of schedule.