Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package roundcubemail for openSUSE:Factory checked in at 2026-11-10 14:40:25 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/roundcubemail (Old) and /work/SRC/openSUSE:Factory/.roundcubemail.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "roundcubemail" Tue Nov 10 14:40:25 2026 rev:98 rq:1396406 version:1.6.21 Changes: -------- --- /work/SRC/openSUSE:Factory/roundcubemail/roundcubemail.changes 2026-10-21 20:58:42.633059527 +0200 +++ /work/SRC/openSUSE:Factory/.roundcubemail.new.3759290/roundcubemail.changes 2026-11-10 14:41:45.915946135 +0100 @@ -1,0 +2,24 @@ +Mon Nov 9 15:03:48 UTC 2026 - Alexander Bergmann <[email protected]> + +- update to 1.6.21 + https://github.com/roundcube/roundcubemail/releases/tag/1.6.21 + CHANGELOG security fixes: + + Fix open redirect via IMAP error recovery on attachment get + + Fix so Received: header includes only trusted hostname and forwarded IP from a trusted proxy + + Fix bug where some managesieve destructive actions could have been triggered cross-site via GET + + Fix Sieve script injection via a rule operator + + Fix Sieve script injection via set/include modifiers + + Fix bug where resolve_url() ignored trusted host setting + + Fix mail header injection via a MDN subject + + Fix HTTP request injection via the spellcheck ATD backend + + Fix IMAP command injection via CRLF in _uid parameter with messages_cache enabled + + Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass + + Fix CSRF validation bypass for file-only POST requests + + Fix disabled_actions restriction bypass by writing '_' instead of '-' in the action name + + Fix CSRF validation bypass for mail purge/expunge commands + + Fix passing potentally unsafe attachment content into ImageMagick on image type conversion + + Fix Unbounded CPU loop/DoS in rcube_session::unserialize() via a negative length token + + Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses + + Fix so IMAP host input is validated more strictly + +------------------------------------------------------------------- Old: ---- roundcubemail-1.6.20-complete.tar.gz roundcubemail-1.6.20-complete.tar.gz.asc New: ---- roundcubemail-1.6.21-complete.tar.gz roundcubemail-1.6.21-complete.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ roundcubemail.spec ++++++ --- /var/tmp/diff_new_pack.mC0PGS/_old 2026-11-10 14:41:47.542014254 +0100 +++ /var/tmp/diff_new_pack.mC0PGS/_new 2026-11-10 14:41:47.544014338 +0100 @@ -20,7 +20,7 @@ %define roundcubeconfigpath %{_sysconfdir}/%{name} Name: roundcubemail -Version: 1.6.20 +Version: 1.6.21 Release: 0 Summary: A browser-based multilingual IMAP client License: BSD-3-Clause AND GPL-2.0-only AND GPL-3.0-or-later ++++++ roundcubemail-1.6.20-complete.tar.gz -> roundcubemail-1.6.21-complete.tar.gz ++++++ ++++ 1654 lines of diff (skipped)
