woodfairy
0a0686ef19
[Nginx][Clamd][Postfix] Rebuild images for brotli CVE-2026-111497
...
The current nginx, clamd and postfix images ship a brotli decoder in the
affected range 1.0.3 - 1.2.0 (CVE-2026-111497, CVSS 9.8, listed in CISA KEV):
- nginx:1.30.6-2 brotli-libs 1.2.0-r1 (fixed in Alpine 3.24: 1.2.1-r0)
- clamd:1.4.6-1 brotli-libs 1.2.0-r1 (fixed in Alpine 3.24: 1.2.1-r0)
- postfix:3.10.12-1 libbrotli1 1.1.0-2+b7 (fixed in trixie-security:
1.1.0-2+deb13u1, DSA-6582-1)
All other mailcow images already contain a fixed version.
clamd and postfix only need a rebuild, which pulls the fixed packages.
The postfix rebuild also picks up Debian's postfix 3.10.13, hence the
new tag postfix:3.10.13-1. The
nginx image never upgraded the packages of its base image, so it only got
fixes when nginx:<version>-alpine was republished. It now runs
apk upgrade like clamd and acme do.
2026-11-08 00:49:55 +01:00
FreddleSpl0it
6a83b9e0f0
[Web] Mailbox protocols do not limit app passwords
2026-11-05 12:46:22 +01:00
FreddleSpl0it
e8f12cd061
[Web] Add Netfilter unban all button
2026-11-04 22:23:16 +01:00
FreddleSpl0it
3a4e479424
[Web] Update group info text
2026-11-04 22:16:10 +01:00
FreddleSpl0it
1752dd6ddf
[SOGo] Update to 5.12.13
2026-11-04 16:54:00 +01:00
FreddleSpl0it
adb1c74ce3
Merge pull request #7589 from mailcow/fix/rework-bugs
...
Fixes for the reworks: imapsync, logins/netfilter, groups, startup, hardening
2026-11-04 16:32:46 +01:00
FreddleSpl0it
716f67844d
[Web] mobileconfig: Wait for a pending account setup
2026-11-04 15:44:57 +01:00
FreddleSpl0it
a2ab4301e7
[Web][Dovecot][Compose] Keep group shares on Enter, no restarts while waiting for the schema, run sync crons on master only
2026-11-04 15:10:40 +01:00
FreddleSpl0it
52f28025a5
[Web][Dovecot] imapsync: Block skipmess in custom params
2026-11-04 12:02:18 +01:00
FreddleSpl0it
3c03f8e567
Merge branch 'fix/sec' into fix/rework-bugs
2026-11-04 11:46:47 +01:00
FreddleSpl0it
72613e7e2b
[Dovecot][Watchdog] Limit the wait for the schema update to 5 minutes
2026-11-04 11:29:00 +01:00
FreddleSpl0it
9293e4ce43
[Web][Dovecot] Do not count denied logins as failed logins
2026-11-04 10:39:32 +01:00
FreddleSpl0it
a8d1121f0e
[Dovecot][Web] imapsync: verify certificates against the source host, make the check optional per source
2026-11-03 09:31:16 +01:00
FreddleSpl0it
a4b60ae26f
[Netfilter][Dovecot] Count failed master logins, log the client address of successful logins
2026-11-02 14:55:42 +01:00
FreddleSpl0it
e96fb24a67
[Nginx][Web] Pass the client address to sogo-auth for EAS/DAV logins
2026-11-02 14:44:09 +01:00
FreddleSpl0it
5c762d9949
[Dovecot][Netfilter] Report failed logins from mailcowauth.php, anchor default rules
2026-11-02 14:11:56 +01:00
FreddleSpl0it
06cbdc4409
[Dockerapi] Pass "--" before positional arguments of doveadm
2026-11-02 10:03:30 +01:00
FreddleSpl0it
7c73199bde
[Web] Groups: limit changes of domain admins to their domains
2026-11-02 10:01:43 +01:00
FreddleSpl0it
4b7ebab8f3
[Web] Mask IdP secrets for read-only API keys, deny sync job OAuth to read-only and pending sessions
2026-11-02 09:56:24 +01:00
FreddleSpl0it
5eb3148bd5
[Web] OIDC/LDAP: check the OAuth state, keep the mailbox on token refresh, require unique IdP users
2026-11-02 09:54:54 +01:00
FreddleSpl0it
41467dc47f
[Web] imapsync: change the server of a sync source only with access to all its sync jobs
2026-11-02 09:50:24 +01:00
FreddleSpl0it
a1cbd51d70
[Dovecot][Web] imapsync: restrict custom parameters and source hosts, verify certificates
2026-11-02 09:49:03 +01:00
milkmaker
1cb0656924
update postscreen_access.cidr ( #7584 )
2026-11-01 21:43:41 +01:00
FreddleSpl0it
510674ee67
[Web] Pending account setup adjustments
2026-10-28 17:11:25 +01:00
FreddleSpl0it
a21604cd7b
[Web][Rspamd] Quarantine link adjustments
2026-10-28 17:06:17 +01:00
FreddleSpl0it
4c7e2ec036
[Nginx] Limit request body size, configurable via NGINX_MAX_BODY_SIZE
2026-10-28 16:54:26 +01:00
FreddleSpl0it
085d10118d
[Nginx][Web] Client address and autodiscover adjustments
2026-10-28 16:36:16 +01:00
FreddleSpl0it
1b6fec6a89
[Web] Hide the sync job form without the syncjobs ACL
2026-10-28 16:24:37 +01:00
FreddleSpl0it
9eb3a79f3b
[Web] Quarantine list adjustments
2026-10-28 16:16:00 +01:00
FreddleSpl0it
d5e3de3ae8
[Web] Add TFA Ratelimit
2026-10-28 16:04:45 +01:00
FreddleSpl0it
e986803980
[Rspamd] Render domain footers without the template engine
2026-10-28 15:50:56 +01:00
FreddleSpl0it
44429fa0d0
[Web] App password and API adjustments
2026-10-28 15:29:55 +01:00
FreddleSpl0it
92ad6c5e6d
[Rspamd] Update to 4.2.3
2026-10-28 12:19:53 +01:00
FreddleSpl0it
4dd7aead73
[Web] Store PKCE data of OAuth2 authorization codes
2026-10-28 11:57:46 +01:00
FreddleSpl0it
bd8c784118
[Web] Update composer libraries
2026-10-28 11:56:29 +01:00
FreddleSpl0it
9cc8ac2908
Merge pull request #7567 from mailcow/feat/netfilter-rework
...
[Netfilter] Rework: robust bans, no restart loops, identity provider outages are no failed logins
2026-10-28 11:24:29 +01:00
FreddleSpl0it
002400315d
Merge pull request #7566 from mailcow/feat/groups
...
[Web][Dovecot][SOGo][DockerApi] Add mailbox groups, shared mailboxes and identity provider sync
2026-10-28 11:21:58 +01:00
FreddleSpl0it
8934a84d18
Merge pull request #7547 from mailcow/feat/apikey-rework
...
[Web] Rework API keys: multiple keys + locked service keys from mailcow.conf
2026-10-28 11:18:47 +01:00
FreddleSpl0it
5ce88b5795
Merge pull request #7546 from mailcow/feat/imapsync-rework
...
[Web][Dovecot] Rework imapsync: sync sources, OAuth2, Python runner
2026-10-28 11:17:09 +01:00
FreddleSpl0it
b2b21b1a85
Merge pull request #7551 from mailcow/renovate/tianon-gosu-1.x
...
Update dependency tianon/gosu to v1.20
2026-10-28 09:05:19 +01:00
FreddleSpl0it
af5d0e3d29
[Dovecot] Update base to Alpine 3.24, build Dovecot 2.3 from Alpine 3.21 packaging
2026-10-28 09:00:45 +01:00
FreddleSpl0it
4884ed0cbf
[Olefy] Update base to Alpine 3.24, fix event loop for Python 3.14
2026-10-28 08:51:33 +01:00
FreddleSpl0it
8aaf68ffb5
[Unbound] Update to 1.26.2, base Alpine 3.24
2026-10-28 08:50:42 +01:00
FreddleSpl0it
503e64fe85
[ACME][Dockerapi][Netfilter][Watchdog] Update base to Alpine 3.24
2026-10-28 08:49:57 +01:00
FreddleSpl0it
ba034568e0
[Web] Add identity provider outage translation, remove unused needs_restart
2026-10-27 12:55:24 +01:00
FreddleSpl0it
1c7c328a2a
[Web][Netfilter] Fix netban limits, no negative ban times, save lists atomically, check banlist id
2026-10-27 12:53:01 +01:00
FreddleSpl0it
7457fd59aa
[Web][Dovecot] Do not count logins as failed while the identity provider is unavailable
2026-10-27 12:46:24 +01:00
FreddleSpl0it
60177720ed
[Netfilter] Rework: keep bans across restarts, repair chain order instead of restarting, one isolation rule per port
2026-10-27 12:35:07 +01:00
FreddleSpl0it
15042e5921
[Web] Add mailbox group and identity provider translations
2026-10-27 10:21:11 +01:00
FreddleSpl0it
3959e311a0
[Web] Add API Documentation for mailbox groups and identity provider sync
2026-10-27 10:20:24 +01:00
woodfairy
FreddleSpl0it
milkmaker