CVS commit: pkgsrc/mail

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Mon Nov  9 13:51:16 UTC 2026

Modified Files:
        pkgsrc/mail/roundcube: Makefile.common distinfo
        pkgsrc/mail/roundcube-plugin-password: distinfo

Log Message:
mail/roundcube: update to 1.6.21

1.6.21 (2026-11-09)

This is a security update to the version 1.6 of Roundcube Webmail.
It provides fixes to recently reported security vulnerabilities:

* Fix open redirect via IMAP error recovery on attachment get, reported by
  Santhoshkumar S.

* Fix so Received: header includes only trusted hostname and forwarded IP
  from a trusted proxy, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.

* Fix bug where some managesieve destructive actions could have been
  triggered cross-site via GET, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.

* Fix Sieve script injection via a rule operator, reported by Squirt1e,
  Atum, N0b0dy, Gh0u1L5.

* Fix Sieve script injection via set/include modifiers, reported by
  Squirt1e, Atum, N0b0dy, Gh0u1L5.

* Fix bug where resolve_url() ignored trusted host setting, reported by
  Squirt1e, Atum, N0b0dy, Gh0u1L5.

* Fix mail header injection via a MDN subject, reported by Squirt1e, Atum,
  N0b0dy, Gh0u1L5

* Fix HTTP request injection via the spellcheck ATD backend, reported by
  Squirt1e, Atum, N0b0dy, Gh0u1L5.

* Fix IMAP command injection via CRLF in _uid parameter with messages_cache
  enabled, reported by dexx-tech.

* Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io
  bypass, reported by blacksw0rd.

* Fix CSRF validation bypass for file-only POST requests, reported by
  skad00sh.

* Fix disabled_actions restriction bypass by writing '_' instead of '-' in
  the action name, reported by skad00sh.

* Fix CSRF validation bypass for mail purge/expunge commands, reported by
  threalwinky.

* Fix passing potentally unsafe attachment content into ImageMagick on image
  type conversion, reported by José Luis Sánchez Pérez - Cybersecurity
  Blue & Red Team.

* Fix Unbounded CPU loop/DoS in rcube_session::unserialize() via a negative
  length token, reported by Guang.

* Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses,
  reported by wyx98765.

* Fix so IMAP host input is validated more strictly, reported by Mohamed
  Elgzouli.


To generate a diff of this commit:
cvs rdiff -u -r1.48 -r1.49 pkgsrc/mail/roundcube/Makefile.common
cvs rdiff -u -r1.105 -r1.106 pkgsrc/mail/roundcube/distinfo
cvs rdiff -u -r1.50 -r1.51 pkgsrc/mail/roundcube-plugin-password/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/mail/roundcube/Makefile.common
diff -u pkgsrc/mail/roundcube/Makefile.common:1.48 pkgsrc/mail/roundcube/Makefile.common:1.49
--- pkgsrc/mail/roundcube/Makefile.common:1.48  Mon Oct 19 14:07:22 2026
+++ pkgsrc/mail/roundcube/Makefile.common       Mon Nov  9 13:51:16 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.48 2026/10/19 14:07:22 taca Exp $
+# $NetBSD: Makefile.common,v 1.49 2026/11/09 13:51:16 taca Exp $
 #
 # used by mail/roundcube/Makefile
 # used by mail/roundcube/plugins.mk
@@ -10,7 +10,7 @@ GITHUB_PROJECT=       roundcubemail
 GITHUB_RELEASE=        ${RC_VERS}
 HOMEPAGE=      https://roundcube.net/
 
-RC_VERS=       1.6.20
+RC_VERS=       1.6.21
 
 USE_LANGUAGES=         # none
 USE_TOOLS+=            pax

Index: pkgsrc/mail/roundcube/distinfo
diff -u pkgsrc/mail/roundcube/distinfo:1.105 pkgsrc/mail/roundcube/distinfo:1.106
--- pkgsrc/mail/roundcube/distinfo:1.105        Mon Oct 19 14:07:22 2026
+++ pkgsrc/mail/roundcube/distinfo      Mon Nov  9 13:51:16 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.105 2026/10/19 14:07:22 taca Exp $
+$NetBSD: distinfo,v 1.106 2026/11/09 13:51:16 taca Exp $
 
-BLAKE2s (roundcubemail-1.6.20-complete.tar.gz) = f75cf0ca9a092ab6e03c6429d0dad4ef7cffc8b99458e79e9d5b250cc673176d
-SHA512 (roundcubemail-1.6.20-complete.tar.gz) = 87eb021329fcca8acdbdf0fb62e19826aa12cba575b3fef7cfe32f8f3a96d10561ed980fbabc2bac35bff4e7fc5b316373274292a46b2cdf26473c0bd1be3692
-Size (roundcubemail-1.6.20-complete.tar.gz) = 5960668 bytes
+BLAKE2s (roundcubemail-1.6.21-complete.tar.gz) = a5f560d8636783e152692c07e709985858fa95ae9c7399dedd56124e14356873
+SHA512 (roundcubemail-1.6.21-complete.tar.gz) = 0130a8b9c41f235331ca8b9d1f0faf283bde48d515e2fd24bef2eccaad27d1953fa906f7a391043666ad0c57dc5ccb80fe41b88583c942f153192470590ea30e
+Size (roundcubemail-1.6.21-complete.tar.gz) = 5962730 bytes
 SHA1 (patch-config_config.inc.php.sample) = 92a48a97b16fe3f5f4b9441fce762a559d8daca7
 SHA1 (patch-program_include_iniset.php) = 8a6c13c0c87d583ed60e43c01a4173d9d802a6a1
 SHA1 (patch-program_lib_Roundcube_rcube__mime.php) = bfefc6850d3db230dd4224491e895fe25a32e87a

Index: pkgsrc/mail/roundcube-plugin-password/distinfo
diff -u pkgsrc/mail/roundcube-plugin-password/distinfo:1.50 pkgsrc/mail/roundcube-plugin-password/distinfo:1.51
--- pkgsrc/mail/roundcube-plugin-password/distinfo:1.50 Mon Oct 19 14:07:22 2026
+++ pkgsrc/mail/roundcube-plugin-password/distinfo      Mon Nov  9 13:51:16 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.50 2026/10/19 14:07:22 taca Exp $
+$NetBSD: distinfo,v 1.51 2026/11/09 13:51:16 taca Exp $
 
-BLAKE2s (roundcubemail-1.6.20-complete.tar.gz) = f75cf0ca9a092ab6e03c6429d0dad4ef7cffc8b99458e79e9d5b250cc673176d
-SHA512 (roundcubemail-1.6.20-complete.tar.gz) = 87eb021329fcca8acdbdf0fb62e19826aa12cba575b3fef7cfe32f8f3a96d10561ed980fbabc2bac35bff4e7fc5b316373274292a46b2cdf26473c0bd1be3692
-Size (roundcubemail-1.6.20-complete.tar.gz) = 5960668 bytes
+BLAKE2s (roundcubemail-1.6.21-complete.tar.gz) = a5f560d8636783e152692c07e709985858fa95ae9c7399dedd56124e14356873
+SHA512 (roundcubemail-1.6.21-complete.tar.gz) = 0130a8b9c41f235331ca8b9d1f0faf283bde48d515e2fd24bef2eccaad27d1953fa906f7a391043666ad0c57dc5ccb80fe41b88583c942f153192470590ea30e
+Size (roundcubemail-1.6.21-complete.tar.gz) = 5962730 bytes
 SHA1 (patch-plugins_password_helpers_passwd-expect) = 15e427a3c90bf7c0437a023b3f099abb5a139165