Today we are releasing CipherMail Email Encryption Gateway 6.5.0.
This is a security hardening release. Nothing in it changes the cryptography; the work went into everything around it: sign-in, sessions, the admin IP restrictions, OpenID Connect, header handling, uploads and Webmail Messenger. Most of the changes are invisible when everything is set up as documented, but a few need a look before you upgrade (see below).
Highlights
Sign-in and passwords
- Failed sign-ins are limited per client address, whatever the user (default 300 in 600 seconds,
configurable, 0 switches it off). Only a wrong password counts.
- The number of password checks running at the same time is bounded (default 8), so a flood of
sign-ins can no longer exhaust the heap. A sign-in which finds no free slot is refused and not counted.
- The 5-failures-per-user limit is checked and counted in one step, so parallel requests cannot try
more passwords. It now also applies to LDAP admins and LDAP Company Portal users. An outage of the
back-end or the LDAP server no longer counts as a failure.
- An unknown portal or Company Portal user gets the same slow answer as a wrong password.
- Signup, password reset and PDF reply links, the system mail HMAC header and TOTP codes are compared
in constant time.
- A new admin password must be at least 12 characters and follow the portal rules; a password with the
system encoding (machine accounts) at least 32. Alphabetical sequences (abcde) are refused like
keyboard sequences already were. Existing passwords are not affected.
Admin access
- The IP addresses an admin is restricted to are checked on every request. A session ends when a
request comes from an address that is not on the list.
- Only the loopback address may set X-Forwarded-For. Behind a trusted proxy, a client with a private
address could claim any address.
- The permission of a property is checked before its user or domain is looked up, so an admin without
the permission can no longer enumerate users and domains.
OpenID Connect and Entra ID
- A login is refused when the provider says the email address is not verified. On by default for the
Company Portal, off for the admin.
- An Entra ID login to the Company Portal requires that Entra ID verified the domain of the email
address (xms_edov claim).
- The administration guide now finds Entra ID admins by object ID (oid), and the bug that broke a
login on an ID-token-only claim is fixed.
Mail processing
- The subject filter is applied to the protected subject of a PGP/MIME or S/MIME message, so a sender
can no longer add a tag such as [signed] through the protected header.
- At most 10 signers of an S/MIME message are checked, and a signer whose signature does not verify is
not trust-checked.
- A line break hidden in an encoded word can no longer be used to inject headers; it becomes a space.
- No PDF password and no portal signup is created for a recipient address that is not valid for the
gateway (goodbye invalid@invalid.tld).
Portals and Webmail Messenger
- Uploads are not read before the login, and are limited: 50 MB portal, 1 MB Company Portal, 100 MB
admin, 5 MB portal forms (configurable).
- Only images with a cid: or data: address are shown. A relative address could be used to mark
another message as read and send its read receipt.
- A message is marked read, and its read receipt sent, by an explicit request after it is displayed,
not when its body is fetched.
- A portal user can send 10 Webmail messages per minute and 200 per day (configurable).
- Failed PDF replies count against the reply limit of the link.
Other changes
- security.txt (RFC 9116) can be served from /.well-known/security.txt (ciphermail_ui__security_txt).
- The default Content Security Policy gains frame-ancestors 'self', base-uri 'self' and object-src 'none'.
- ciphermail_ui__ssl_signature_algorithms sets the TLS signature algorithms, for example to stop
SHA-1 under the LEGACY crypto policy.
- Cockpit can be bound to an address, and ciphermail_ui__additional_config adds httpd configuration
for every web UI (with an Azure Front Door example in the guide). The playbook runs httpd -t before
replacing the running configuration.
- UI: input labels are linked to their fields for screen readers, many translations fixed, sidebar logo
size and alt text are brandable, clicking the active menu item reloads the page.
Read this before upgrading
- Re-check the admin IP address lists.
10.1.2.5/24is now the whole /24, an IPv6 address is one host and no longer its /64, and an empty entry or a bare prefix length is refused. An admin whose list holds only empty entries cannot sign in until it is fixed (auth admin ip-addresses clearwith the localcliadmin). - X-Forwarded-For is trusted from loopback only. If your web server connects to a back-end from
another address, extend
ciphermail_*__remoteip_internal_proxies, and remove anyserver.tomcat.remoteip.internal-proxiesentry from*__user_defined_system_properties. - Company Portal with OpenID Connect: logins with an unverified email address are refused by default.
A Keycloak with LDAP-federated or brokered users marks every address unverified unless "Trust Email"
is on. With Entra ID, add the optional claims
emailandxms_edovto the ID token, or every login is refused. - Webmail REST clients of your own:
GET /api/webmail/getBodyAndAttachmentsno longer marks the message as read. CallPOST /api/webmail/messageDisplayedafter showing it. - The web UI bind addresses must be IP addresses. httpd now listens only on the configured address and does not start when a host name does not resolve to the machine.
ciphermail_backend__remote_pdf_otp_headerandciphermail_backend__remote_webmail_headermust be plain header names, or the gateway does not process mail.- An override of
ciphermail_ui__cspshould add the new directives itself. /api/user/getUser(CLIuser get) answers 404 for an unknown user instead of an empty 200. UseisUser(user check) to test for existence.- Permissions that could never be used (portal password, 2FA or OTP secret at domain or global level) are removed. Existing roles keep working; setting a list that contains one is refused.