How to Safely Upgrade Roundcube to 1.6.11 on HestiaCP (Security Fix)

[ahmedhaseeb]

Hi everyone,

With the recent security vulnerability affecting Roundcube versions 1.6.x and 1.5.x (except 1.6.11 and 1.5.10), I want to update my installation to Roundcube 1.6.11.

I tried running v-add-sys-roundcube hoping it would fetch the latest version, but it seems HestiaCP currently provides only version 1.6.10:

root@srv1 ~ # v-add-sys-roundcube
Error: Installed version (1.6.10) is equal to the available version (1.6.10)

Is there an official or recommended guide for manually upgrading Roundcube to 1.6.11 without breaking future HestiaCP-managed updates or the integration?

Any help or best practices for doing this safely would be greatly appreciated.

Reference:
Security updates 1.6.11 and 1.5.10 released

Thanks in advance!

[sahsanu]

Hi @ahmedhaseeb

Check this post:

Roundcube security update just released

Hi @jperkins Thanks for sharing this update. As it fixes a security bug: Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v. That basically means the vulnerability is an RCE (Remote Code Execution) and requires valid credentials to be exploited (i.e., it’s post-auth). Even though a user must be logged in to take advantage of this vulnerability, I strongly recommend updating Roundcube immediately. I’ve created this PR to bump Roundcube to version 1.6.11. I already wrote a m…