Hi Salvatore, On Sun, 06 Sep 2026 at 14:54:22 +0200, Salvatore Bonaccorso wrote: > On Sun, Sep 06, 2026 at 12:20:17PM +0200, Guilhem Moulin wrote: >> On Sun, 06 Sep 2026 at 11:31:01 +0200, Guilhem Moulin wrote: >>> 12. SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 >>> addresses >>> https://github.com/roundcube/roundcubemail/commit/05cc67c6bc501e2d818436dec571f9712f16ea61 >> >> The Debian package (in all suites) is not affected by that one, because >> my patch to avoid the mlocati/ip-lib dependency already handles these >> addresses. > > That is every updated version which contain the > Avoid-dependency-on-new-package-mlocati-ip-lib.patch patch right?
Yup indeed, local v4 ranges are mapped to v6 via the following block https://salsa.debian.org/roundcube-team/roundcube/-/blob/debian/1.6.19+dfsg-1/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch?ref_type=tags#L210 and then compared to using @inet_pton(). The same block is present in all supported suites (bookworm LTS, trixie, forky/sid), and support for non quad-dotted IPs and non-decimal fields, which is what this vulnerability is about, was added in 1.6.16+dfsg-1 (forky/sid) 1.6.16+dfsg-0+deb13u1 (trixie) 1.6.5+dfsg-1+deb12u9 (bookworm) 1.4.15+dfsg.1-1+deb11u9 (bullseye) So these versions and the later ones are not affected by this vulnerability. (Confirmed by backporting upstream's unit test.) FWIW I pointed upstream at the d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch to avoid Factory::parseRangeString()'s limitations (and save a dependency). They may or may not be interested in applying it upstream. -- Guilhem.
signature.asc
Description: PGP signature
