mailinabox.email is down. How to update?

[ikarus23]

Hi https://mailinabox.email is down since yesterday. Meanwhile, I wanted to update my installation. Te recommended procedure is to curl -s https://mailinabox.email/setup.sh | sudo bash. But since the website is down, is there another recommended way to update? Checkout the next git release tag and do sudo mailinabox?

[nodiscc]

Ref. awesome-selfhosted/awesome-selfhosted#1767

[ikarus23]

Looks like port 80 (HTTP) is still up, but it redirects to 443 (HTTPS). However, port 443 is filtered/closed.

[flo269]

@ikarus23 look here for an explanation and a "workaround" ;-)
#1663 (comment)

[ikarus23]

@flo269 Thanks for clearing that up. So mailinabox.email is down because of the security risk coming from CVE-2019-11043.

But I was not able to find a workaround for my update issue. Can someone explain to me the best practice to update my MiaB installation without the website (from 0.42b to 0.43)? Or did I just missed the "workaround"?

[flo269]

I would just give the manual install instructions a go. If I'm not mistaking, install and update are the same script.

https://github.com/mail-in-a-box/mailinabox#installation

Oh, and the website can also be cloned from here, so you still have access to the guide etc.

https://github.com/mail-in-a-box/mailinabox.email

[ikarus23]

@flo269 Thank you! Looks good!

[akaJedi]

@flo269 Thanks for clearing that up. So mailinabox.email is down because of the security risk coming from CVE-2019-11043.

But I was not able to find a workaround for my update issue. Can someone explain to me the best practice to update my MiaB installation without the website (from 0.42b to 0.43)? Or did I just missed the "workaround"?

Does this CVE-2019-11043 affecting our mailinabox servers as well? Should we take some actions to prevent it?

[zonetransferagent]

@flo269 Thanks for clearing that up. So mailinabox.email is down because of the security risk coming from CVE-2019-11043.
But I was not able to find a workaround for my update issue. Can someone explain to me the best practice to update my MiaB installation without the website (from 0.42b to 0.43)? Or did I just missed the "workaround"?

Does this CVE-2019-11043 affecting our mailinabox servers as well? Should we take some actions to prevent it?

Suggest you block 443 access to your boxes as a precaution. If you need admin access you could allow 443 from your IP and block that port from everywhere else.

https://discourse.mailinabox.email/t/discussion-cve-2019-11043-php-fpm-could-lead-to-remote-code-execution-on-nginx/5604

[akaJedi]

@pohutukawanz you posted the link which lead to "No results matched your search".

[zonetransferagent]

@pohutukawanz you posted the link which lead to "No results matched your search".

Sorry! Try:

https://discourse.mailinabox.email/t/discussion-cve-2019-11043-php-fpm-could-lead-to-remote-code-execution-on-nginx/5604

[ikarus23]

Thanks @flo269. Using the manual installation process worked great for updating my MiaB (once I fixed some minor permission errors).