Skip to content

Release v4.5.0

Choose a tag to compare

View all tags
@andreeapid andreeapid released this 22 Oct 07:06
· 78 commits to main since this release
v4.5.0
03123ae

Highlights

  • Automated file fixes and cleaning now prevent account owners from changing files outside their account. Upgrade every host.
  • With automatic blocking on, sources probing for the PHP2Shell flaw are now blocked at the firewall on their first blocked request.
  • PHP hardening audits now flag unsafe fatal error backtrace settings on PHP 8.5 and later.
  • Central intelligence downloads now support node authentication with an existing reporting identity.
  • The Email Security page now shows mail decision counts, monitoring gaps, recent rejects, rspamd status and groups needing attention.
  • Validation and doctor now warn when the web UI accepts admin logins from any network without a CSM restriction.
  • ModSecurity warnings alone no longer trigger firewall bans.

Security

  • Automated file fixes and cleaning now prevent account owners from changing files outside their account.
  • With automatic blocking on, sources probing for the PHP2Shell flaw are now blocked at the firewall on their first blocked request.
  • Failed central intelligence downloads no longer expose download addresses or access tokens in logs.
  • PHP hardening audits no longer report unsafe PHP-FPM settings as safe.

18 changes in this release. Full detail: CHANGELOG.md

Full changelog

Highlights

  • Automated file fixes and cleaning now prevent account owners from changing files outside their account. Upgrade every host.
  • With automatic blocking on, sources probing for the PHP2Shell flaw are now blocked at the firewall on their first blocked request.
  • PHP hardening audits now flag unsafe fatal error backtrace settings on PHP 8.5 and later.
  • Central intelligence downloads now support node authentication with an existing reporting identity.
  • The Email Security page now shows mail decision counts, monitoring gaps, recent rejects, rspamd status and groups needing attention.
  • Validation and doctor now warn when the web UI accepts admin logins from any network without a CSM restriction.
  • ModSecurity warnings alone no longer trigger firewall bans.

Security

  • Automated file fixes and cleaning now prevent account owners from changing files outside their account.
  • With automatic blocking on, sources probing for the PHP2Shell flaw are now blocked at the firewall on their first blocked request.
  • Failed central intelligence downloads no longer expose download addresses or access tokens in logs.
  • PHP hardening audits no longer report unsafe PHP-FPM settings as safe.

Added

  • Central intelligence downloads now support node authentication with an existing reporting identity. Select that identity in central settings and restart to enable it.
  • Integrations can now read mail decision statistics, recent rejects, available email checks and rspamd health through the API.

Changed

  • PHP hardening audits now flag unsafe fatal error backtrace settings on PHP 8.5 and later.
  • Validation and doctor now warn when the web UI accepts admin logins from any network and neither the CSM firewall nor token address limits restrict it.
  • The Email Security page now shows persistent mail counts, a chart, monitoring gaps, recent rejects, rspamd status and groups needing attention. Follow the antispam guide if rspamd counters are unavailable.
  • Docs and command output now describe the integrity check as recorded hashes, not signatures, and note what it cannot stop.

Fixed

Firewall and blocking

  • ModSecurity warnings alone no longer trigger firewall bans.
  • Disabling firewall escalation for a ModSecurity rule now prevents further bans from its earlier matches.
  • Firewall-only restores now import consistent firewall state and action history, refusing unfinished actions or undelivered audits without changing existing data.

Login and mail monitoring

  • IPv6 loopback logins no longer raise alerts, and untrackable SSH hostnames produce a single diagnostic warning.
  • Mail login tracking now skips private IPv6 clients as it already skipped private IPv4 ranges, so internal clients are not blocked.

Automatic response

  • Automatic permission fixes no longer change a file that stopped being world- or group-writable after the scan.
  • Findings resolved by the automatic permission fix now leave the Findings page instead of staying listed until the next scan.

Hardening audit

  • The PHP end-of-life audit no longer says old branches get no security fixes; it points to vendor backports instead.
Assets 22
Loading