Security update request: NS8 Mail 1.7.12 still ships ClamAV 1.4.2

Feature
, , ,
1

Summary

The ClamAV container shipped with NS8 Mail 1.7.12 currently contains ClamAV 1.4.2-r0.

FreshClam reports:

WARNING: Your ClamAV installation is OUTDATED!
Local version: 1.4.2
Recommended version: 1.4.5

The signature database itself updates successfully. This report concerns the scanner engine packaged in the NS8 container, not the FreshClam database-update mechanism.

ClamAV 1.4.5 is a security patch release and fixes multiple vulnerabilities that also affect 1.4.2.

Official release information:

https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.4.5

Environment

  • NS8 Mail: 1.7.12

  • Container image: ghcr.io/nethserver/mail-clamav:1.7.12

  • Image digest:
    sha256:b21aced719c22a6989fec307d81613ee19557037844708970b07329853b9b98a

  • Image creation date: 2026-06-26

  • Base OS: Alpine 3.21.7

  • Architecture: x86_64

  • Installed packages:

    • clamav-clamdscan-1.4.2-r0

    • clamav-daemon-1.4.2-r0

    • clamav-libs-1.4.2-r0

    • clamav-scanner-1.4.2-r0

Current runtime status

ClamAV is operational:

PONG
ClamAV 1.4.2/28073/Sun Jul 26 06:25:14 2026

FreshClam successfully updated and validated the official databases:

  • daily database: 28073

  • main database: 63

  • bytecode database: 339

  • database tests: passed

  • clamd notification/reload: successful

Therefore, FreshClam is working correctly. It cannot upgrade the ClamAV engine binary.

Cause identified

The NS8 Mail image is built from:

alpine:3.21.7

and installs the scanner through:

apk add --no-cache clamav-daemon clamav-scanner
apk add --no-cache freshclam

NS8 does not explicitly pin ClamAV 1.4.2. The version comes from the Alpine 3.21 community repository, which currently provides 1.4.2-r0.

Relevant NS8 source:

https://github.com/NethServer/ns8-mail/blob/1.7.12/build-images.sh

Alpine package information:

https://pkgs.alpinelinux.org/package/v3.21/community/x86_64/clamav

ClamAV 1.4.5 was released on 2026-07-01, after NS8 Mail 1.7.12 was built.

The current NS8 Mail main branch still uses Alpine 3.21.7. The general Alpine 3.22 upgrade is also currently blocked by the Dovecot 2.3 to 2.4 migration:

https://github.com/NethServer/ns8-mail/pull/202

Security impact

ClamAV 1.4.5 fixes several vulnerabilities affecting earlier versions, including 1.4.2. These include malformed-file parsing issues that may cause scanner crashes, memory corruption, excessive temporary-storage use, or scan-limit handling problems.

Because this instance processes untrusted Internet email attachments, we consider the engine update security-relevant rather than only a cosmetic version warning.

Requested resolution

Could NethServer please provide an official, supported update for the mail-clamav image containing ClamAV 1.4.5 or an officially backported equivalent?

Possible supported approaches could include:

  1. Rebuilding only the mail-clamav image on a newer compatible Alpine base.

  2. Providing an official backported ClamAV 1.4.5 package for the existing image.

  3. Using another tested packaging method that does not require upgrading every NS8 Mail container to the same Alpine version.

If only the ClamAV image is moved to a newer Alpine release, please verify:

  • compatibility with clamav-unofficial-sigs;

  • persistent official and unofficial signature volumes;

  • FreshClam notification and clamd reload;

  • Rspamd connectivity to clamd;

  • update and rollback behavior;

  • backup and restore compatibility.

2

Hi Agustinus, thank you for the report. Did you check if the fixes were backported by Alpine’s team to 1.4.2?

Having said that, I must admit that 3.21 is near to EOL and we must move soon to a newer Alpine release, or rebase the whole stack on Debian 12. We are still on a plan phase for this.

3

Hi Davide,

Thank you for pointing out the possibility of a downstream backport. I checked the Alpine v3.21 package metadata, APKBUILD, security metadata, and package history, but I could not find evidence that the ClamAV 1.4.5 security fixes were backported into clamav-1.4.2-r0.

The v3.21 package still uses:

  • pkgver=1.4.2

  • pkgrel=0

  • the upstream clamav-1.4.2.tar.gz source

The package was built on February 23, 2025. Its secfixes entry for 1.4.2-r0 lists only CVE-2025-20128, and I could not find a later ClamAV package rebuild, revision increment, or additional security patch in the 3.21-stable history.

Upstream ClamAV states that six of the vulnerabilities fixed in 1.4.5 also affect ClamAV 1.4.2 on 64-bit systems. CVE-2026-20244 is limited to 32-bit builds and therefore does not apply to the x86_64 NS8 image.

References:

I also noted that ClamAV is provided by Alpine’s community repository, while Alpine v3.21 is now listed with main support only. This makes receiving a normal community-package security update less certain.

Would NethServer consider one of the following interim solutions?

  1. An official backport of the ClamAV 1.4.5 security fixes for the existing mail-clamav image; or

  2. An official rebuild of only mail-clamav on a newer compatible base that provides ClamAV 1.4.5.

Since mail-clamav is built as a separate image, an isolated rebuild may allow the scanner engine to be fixed without waiting for the full Dovecot or mail-stack migration. This would of course still require testing of unofficial signatures, persistent signature volumes, FreshClam notification and reload, Rspamd connectivity, backup/restore, and upgrade/rollback behavior.

Could you also advise:

  • whether an official patched image is planned;

  • the expected release or target timeline; and

  • whether NethServer recommends any supported mitigation in the meantime?

We have intentionally not upgraded packages inside the running container or mixed Alpine repositories, because this is a production system and we want to remain on a supported NS8 configuration.

Thank you.

1 Like