erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: June 2, 2020

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: Roundcube CVE-2020-13965: XML Attachment XSS, KEV in 2024. Anyone running Roundcube older than 1.4.5 or 1.3.12, including copies bundled in old hosting panels or appliances, and admins who re-added text/xml to client_mimetypes.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2020-13965

Roundcube CVE-2020-13965: XML Attachment XSS, KEV in 2024

Fixed in June 2020; if any Roundcube you run is still on 1.4.4 or older, this bug is the least of its problems, so upgrade it to a current release and check mailboxes for signs of theft.

Must act: Anyone running Roundcube older than 1.4.5 or 1.3.12, including copies bundled in old hosting panels or appliances, and admins who re-added text/xml to client_mimetypes.

Can relax: Sites on a current Roundcube 1.6 LTS or 1.7 release with default attachment preview settings.

  1. Check the version on every Roundcube install with grep RCMAIL_VERSION program/include/iniset.php.
  2. Upgrade anything older than 1.6.20 or 1.7.5 to a current release; the October 2026 fixes cover only the 1.6 LTS and 1.7 branches.
  3. Make sure client_mimetypes in config/config.inc.php does not list text/xml.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.