Security update version 78 posted & PHP security vulnerability

Announcements
1

I’ve just posted version 78. Although it includes a security update to Roundcube, the bigger issue this week was major security issues in PHP.

Updates to PHP are available through the normal Ubuntu update commands. Log into your box with ssh and then run:

apt-get update
apt-get upgrade

For more see Advice/Quick requirements related to the PHP vuln? - #25 by ice2k2.

To upgrade Mail-in-a-Box to get the latest Roundcube (see the CHANGELOG), run the same command you used to install Mail-in-a-Box. See Mail-in-a-Box Maintenance Guide for more instructions.

6 Likes
2

After the updates you can run following test for additional peace of mind

1 Like
3

Thanks for getting a new version to address these issues so quickly.

1 Like
4

Thanks for this!

1 Like
5

I am getting this today when running the install/upgrade script. Any ideas?

Upgrading to Nextcloud version 21.0.7


sha1sum: WARNING: 1 computed checksum did NOT match

------------------------------------------------------------

Download of https://github.com/nextcloud-releases/contacts/releases/download/v4.0.7/contacts-v4.0.7.tar.gz did not match expected checksum.

Found:

8ab31d205408e4f12067d8a4daa3595d46b513e3  /tmp/contacts.tgz



Expected:

45e7cf4bfe99cd8d03625cf9e5a1bb2e90549136  /tmp/contacts.tgz
7

What version of miab are you currently running, and what version of Ubuntu?

8

It was the current version (v78) as it had only been migrated to this server last week.

Its Ubuntu 22.04.5 LTS with ESM enabled and fully patched up.

The status page reports:

Mail-in-a-Box is up to date. You are running version v78.

Other than the failed install script - with a reboot it’s still passing mail and web mail interface is working. Don’t otherwise use the Nextcloud but it seems like something may have been upgraded at their end in the last few hours.

9

can you grab the Nextcloud version the system thinks you’re on?

cat /home/user-data/owncloud/config.php

JUST the ‘version’ value, near the end of the output. Do not paste anything. Visually confirm, and type the version.

edit: this assumes you have the default ${STORAGE_ROOT} location. amend the command accordingly

cat ${STORAGE_ROOT}/owncloud/config.php

10

When you say “grab” what do you mean specifically? (apologies as not sure if you meant you wanted the version or an install as you where quite specific later but I am missing some caffeine…)

'version' => '20.0.14.2',

1 Like
11

inside mailinabox/setup/nextcloud.sh It is trying to execute this code:

`if [[ ${CURRENT_NEXTCLOUD_VER} =~ ^20 ]]; then
	InstallNextcloud 21.0.7 f5c7079c5b56ce1e301c6a27c0d975d608bb01c9 4.0.7 45e7cf4bfe99cd8d03625cf9e5a1bb2e90549136 3.0.4 d0284b68135777ec9ca713c307216165b294d0fe
	CURRENT_NEXTCLOUD_VER="21.0.7"
fi`

if you update the 2nd hash with the hash from the output ( 8ab31d205408e4f12067d8a4daa3595d46b513e3 ), and then rerun, it should continue.

For some reason, the hash switched from 8ab31d205408e4f12067d8a4daa3595d46b513e3 to the current code.

12

offending commit where the hash was changed:

Setup fixes for Ubuntu 22.04 · mail-in-a-box/mailinabox@91fc74b

13

Hi David, truly appreciate the help but still somewhat stymied. Teach me to try and upgrade on a Saturday morning…

From console:

Upgrading Nextcloud --- backing up existing installation, configuration, and database to directory to /home/user-data/owncloud-backup/2026-10-24-09:50:30...

Upgrading to Nextcloud version 21.0.7

sha1sum: WARNING: 1 computed checksum did NOT match

------------------------------------------------------------

Download of https://github.com/nextcloud-releases/contacts/releases/download/v4.0.7/contacts-v4.0.7.tar.gz did not match expected checksum.

Found:

8ab31d205408e4f12067d8a4daa3595d46b513e3  /tmp/contacts.tgz


Expected:

45e7cf4bfe99cd8d03625cf9e5a1bb2e90549136  /tmp/contacts.tgz

The Current mailinabox/setup/nextcloud.sh:

                if [[ ${CURRENT_NEXTCLOUD_VER} =~ ^20 ]]; then

                        InstallNextcloud 21.0.7 f5c7079c5b56ce1e301c6a27c0d975d608bb01c9 4.0.7 8ab31d205408e4f12067d8a4daa3595d46b513e3 3.0.4 d0284b68135777ec9ca713c307216165b294d0fe 1.0.0 3bf2609061d7214e7f0f69dd8883e55c4ec8f50a

#                       InstallNextcloud 21.0.7 f5c7079c5b56ce1e301c6a27c0d975d608bb01c9 4.0.7 45e7cf4bfe99cd8d03625cf9e5a1bb2e90549136 3.0.4 6fb1e998d307c53245faf1c37a96eb982bbee8ba 1.0.0 3bf2609061d7214e7f0f69dd8883e55c4ec8f50a

                        CURRENT_NEXTCLOUD_VER="21.0.7"

                fi

Any thoughts as to what to try next? (Neither the original or commented line versions work)

14 
cp /mailinabox/setup/nextcloud.sh /mailinabox/setup/nextcloud.sh.bak

nano /mailinabox/setup/nextcloud.sh

completely delete the old line, so that only the new line remains (with the updated hash):

#                       InstallNextcloud 21.0.7 f5c7079c5b56ce1e301c6a27c0d975d608bb01c9 4.0.7 45e7cf4bfe99cd8d03625cf9e5a1bb2e90549136 3.0.4 6fb1e998d307c53245faf1c37a96eb982bbee8ba 1.0.0 3bf2609061d7214e7f0f69dd8883e55c4ec8f50a

Save & Exit

Remove the downloaded package (confirm it is there with ls):

cd /tmp/
ls
rm ./contacts.tgz

Run the script again:

cd ~/mailinabox
./setup/start.sh

If this doesn’t resolve the issue, start a new topic for further troubleshooting. I’ll do my best to provide as much support as possible.

15

I have started a new topic as there is something else going on but to confirm learnings:

  1. Edit “sudo nano ./setup/nextcloud.sh” and dont comment out lines you actually need to replace it for some reason.
  2. The amended line with all hashes that work is below.

InstallNextcloud 21.0.7 f5c7079c5b56ce1e301c6a27c0d975d608bb01c9 4.0.7 8ab31d205408e4f12067d8a4daa3595d46b513e3 3.0.4 6fb1e998d307c53245faf1c37a96eb>

  1. Make sure you run the setup locally rather than downloading again (which will overwrite your changes)

:~/mailinabox$ sudo ./setup/start.sh

16

This topic was automatically closed 6 days after the last reply. New replies are no longer allowed.