Roundcube Webmail upstream has released v0.5.1 version: [1] http://trac.roundcube.net/wiki/Changelog which adds one security hardening: 1), Security: add optional referer check to prevent CSRF in GET requests Relevant patches: [2] http://trac.roundcube.net/changeset/4503 [3] http://trac.roundcube.net/changeset/4504 and fixes two security flaws: 2), Security: protect login form submission from CSRF Relevant patch: [4] http://trac.roundcube.net/changeset/4490 3), Security: prevent from relaying malicious requests through modcss.inc Relevant patch: [5] http://trac.roundcube.net/changeset/4488 References: [6] http://www.openwall.com/lists/oss-security/2011/03/24/3 (CVE Request) [7] http://roundcube.net/news [8] http://sourceforge.net/news/?group_id=139281&id=297236
This issues affect the versions of the roundcubemail package, as shipped with Fedora release of 13 and 14. This issue affect the version of the roundcubemail package, as present within EPEL-6 repository. Please schedule an update.
Created roundcubemail tracking bugs for this issue Affects: fedora-all [bug 690457] Affects: epel-6 [bug 690458]
Ugh. I can't even go higher than 0.3.1 on F-13, F-14, or EPEL-6 because of the available version of php-pear-MDB2. I'll get 0.5.1 to rawhide and F-15 after testing, then work on backporting. . .
The CVE-2011-1491 and CVE-2011-1492 identifiers have been assigned (http://www.openwall.com/lists/oss-security/2011/04/04/50) to these issues (quoting exact reply from Josh to be visible at first sight, which id was assigned to which issue / patch): =============================================== Subject: Re: CVE request: roundcube < 0.5.1 CSRF Thanks for sorting this Jan. > > http://trac.roundcube.net/wiki/Changelog > > > > two cross site request forgery, one additional issue fixed in 0.5.1: > > > > "Security: add optional referer check to prevent CSRF in GET > > requests > > Looks this one being just security hardening with the patches: > [1] http://trac.roundcube.net/changeset/4503 > [2] http://trac.roundcube.net/changeset/4504 > > For the CSRF flaws: > > > Security: protect login form submission from CSRF > Patch: [3] http://trac.roundcube.net/changeset/4490 Use CVE-2011-1491 for the above. > > > Security: prevent from relaying malicious requests through > > modcss.inc" > Patch: [4] http://trac.roundcube.net/changeset/4488 > Use CVE-2011-1492 for the above. Thanks. -- JB