[Pkg-roundcube-maintainers] Bug#1146838: roundcube: Multiple security vulnerabilities

[Salvatore Bonaccorso]

Hi Guilhem,

On Sun, Sep 06, 2026 at 03:36:50PM +0200, Guilhem Moulin wrote:
> Hi Salvatore,
> 
> On Sun, 06 Sep 2026 at 14:54:22 +0200, Salvatore Bonaccorso wrote:
> > On Sun, Sep 06, 2026 at 12:20:17PM +0200, Guilhem Moulin wrote:
> >> On Sun, 06 Sep 2026 at 11:31:01 +0200, Guilhem Moulin wrote:
> >>> 12. SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4
> >>> addresses
> >>> https://github.com/roundcube/roundcubemail/commit/05cc67c6bc501e2d818436dec571f9712f16ea61
> >>
> >> The Debian package (in all suites) is not affected by that one, because
> >> my patch to avoid the mlocati/ip-lib dependency already handles these
> >> addresses.
> >
> > That is every updated version which contain the
> > Avoid-dependency-on-new-package-mlocati-ip-lib.patch patch right?
> 
> Yup indeed, local v4 ranges are mapped to v6 via the following block
> https://salsa.debian.org/roundcube-team/roundcube/-/blob/debian/1.6.19+dfsg-1/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch?ref_type=tags#L210
> and then compared to using @inet_pton().
> 
> The same block is present in all supported suites (bookworm LTS, trixie,
> forky/sid), and support for non quad-dotted IPs and non-decimal fields,
> which is what this vulnerability is about, was added in
> 
>     1.6.16+dfsg-1 (forky/sid)
>     1.6.16+dfsg-0+deb13u1 (trixie)
>     1.6.5+dfsg-1+deb12u9 (bookworm)
>     1.4.15+dfsg.1-1+deb11u9 (bullseye)
> 
> So these versions and the later ones are not affected by this
> vulnerability.  (Confirmed by backporting upstream's unit test.)
> 
> FWIW I pointed upstream at the d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch
> to avoid Factory::parseRangeString()'s limitations (and save a dependency).  They
> may or may not be interested in applying it upstream.

Thanks, I have updated the entry as

CVE-2026-XXXX [SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses]
        - roundcube 1.6.14+dfsg-1 (bug #1146838)
        [trixie] - roundcube 1.6.15+dfsg-0+deb13u1
        [bookworm] - roundcube 1.6.5+dfsg-1+deb12u8

(bullseye should go to the ELTS tracker).

Let me know. I will try to request CVEs. If I do so I will let you now
to avoid duplicate work.

Regards,
Salvatore