Roundcube fixed 20 webmail flaws. Ours was updated overnight

Roundcube is open-source webmail that many hosting companies use. A flaw in it is a flaw in the page where you read and write your mail, so what matters most is how soon the fix arrives.

What was fixed#

The Roundcube project released versions 1.7.5 and 1.6.20 on 19 October, with the same 20 security fixes in both. Most of the flaws were in parts of webmail you see and use:

• Mail you send. Four could slip extra hidden lines, called headers, into an email you were sending, for example through the subject of a message you forwarded.
• Mail you open. Two let a message load pictures from the internet when webmail was set to ask you first; pictures loaded that way are how many senders tell whether you opened their mail. One let a message's own styling reach outside it and change the webmail page around it, and two were in how webmail shrinks and converts attached pictures to show them to you.
• The rest of webmail. Two could pass extra commands to the server that stores your mailbox, through the options that show a message's source or mark it. One let another website make your browser mark messages as junk while you were signed in, and one could let an error message on the password change page run code in your browser. Our webmail has the junk button and the password page.

The others were in webmail's own workings, such as how it keeps track of your signed-in session, or in parts our webmail doesn't use, such as the part of the password page that works with a different mail system.

Roundcube itself didn't rate how serious the flaws are. The first CVE record, published on 20 October for one of the mail-server command flaws, rates it high, for an attacker who is already signed in to a mailbox. We have seen no reports of any of these flaws being used in attacks.

When it reached our webmail#

Every night our webmail checks for updates to the Roundcube version it runs and installs them on its own. Before keeping a new version, it checks that the sign-in page loads and that it can still connect to the mail server; if either check fails, it goes back to the previous version by itself.

Roundcube published 1.7.5 at 07:02 UTC on 19 October. Our nightly update installed it at 03:50 UTC on 20 October, about 21 hours later, in place of 1.7.4. Nobody had to step in.

Our hosting servers also have a second copy of Roundcube, the one built into cPanel. You don't use it unless we have set your account up to open mail from inside cPanel: the webmail links on our site and in your client area, and an old webmail.yourdomain.com bookmark, all lead to webmail.maxinodes.com. cPanel updates its copy with its own releases and hasn't yet released the version with these fixes, 1.6.20. When it does, our servers install it automatically in their nightly cPanel update, and we'll add the date here.

What you need to do#

Nothing. Mail apps such as Outlook, Apple Mail or the one on your phone don't use Roundcube at all, so these flaws never reached them.

If something in webmail doesn't work the way it did, tell us.