[Pkg-roundcube-maintainers] Bug#1146838: roundcube: Multiple security vulnerabilities

[Guilhem Moulin]

Hi Salvatore,

On Sun, 06 Sep 2026 at 14:54:22 +0200, Salvatore Bonaccorso wrote:
> On Sun, Sep 06, 2026 at 12:20:17PM +0200, Guilhem Moulin wrote:
>> On Sun, 06 Sep 2026 at 11:31:01 +0200, Guilhem Moulin wrote:
>>> 12. SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4
>>> addresses
>>> https://github.com/roundcube/roundcubemail/commit/05cc67c6bc501e2d818436dec571f9712f16ea61
>>
>> The Debian package (in all suites) is not affected by that one, because
>> my patch to avoid the mlocati/ip-lib dependency already handles these
>> addresses.
>
> That is every updated version which contain the
> Avoid-dependency-on-new-package-mlocati-ip-lib.patch patch right?

Yup indeed, local v4 ranges are mapped to v6 via the following block
https://salsa.debian.org/roundcube-team/roundcube/-/blob/debian/1.6.19+dfsg-1/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch?ref_type=tags#L210
and then compared to using @inet_pton().

The same block is present in all supported suites (bookworm LTS, trixie,
forky/sid), and support for non quad-dotted IPs and non-decimal fields,
which is what this vulnerability is about, was added in

    1.6.16+dfsg-1 (forky/sid)
    1.6.16+dfsg-0+deb13u1 (trixie)
    1.6.5+dfsg-1+deb12u9 (bookworm)
    1.4.15+dfsg.1-1+deb11u9 (bullseye)

So these versions and the later ones are not affected by this
vulnerability.  (Confirmed by backporting upstream's unit test.)

FWIW I pointed upstream at the d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch
to avoid Factory::parseRangeString()'s limitations (and save a dependency).  They
may or may not be interested in applying it upstream.

-- 
Guilhem.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-roundcube-maintainers/attachments/20260906/67270e34/attachment.sig>