When are we going to see about updating for this Roundcube 0-Day?

Support
,
21

You can do a test also by disabling this plugin and upgrade. Honestly I am not sure because it is a security fix release and I am quite sure the changes are tiny…but who knows

22

@stephdl Hi to a new week.
Just updated roundcube again, disabled the 2fa plugin and roundcube works as expected with 1.4.15, re-enabled the 2fa plugin and back to the blank page with the error.
So at this point it’s update for the cve and lose 2fa or don’t update and … well.

What do you suggest now that it definitely seems that the 2fa plugin crashes roundcube 1.4.15?

1 Like
23

We fetch the plugin branch of this github repository

It seems not really alive so a this point either find another plugins I have not much to say, we have the last version

Not tested but I am not sure it works with 1.5.5 (nethserver-roundcubemail-next), if yes it could be an option or find another plugin

1 Like
24

2 posts were split to a new topic: Roundcubemail 1.6.5 needs testers

25

I guess that…
image
Patched 1.4 version is installed. But Nethserver package and Roundcube package versions do not match; probably irrelevant?

Side question: worth an upgrade to roundcube 1.5?

1 Like