CipherMail Gateway 6.5.0 released

General
1

Today we are releasing CipherMail Email Encryption Gateway 6.5.0.

This is a security hardening release. Nothing in it changes the cryptography; the work went into
everything around it: sign-in, sessions, the admin IP restrictions, OpenID Connect, header handling,
uploads and Webmail Messenger. Most of the changes are invisible when everything is set up as
documented, but a few need a look before you upgrade (see below).

Highlights

Sign-in and passwords

  • Failed sign-ins are limited per client address, whatever the user (default 300 in 600 seconds,
    configurable, 0 switches it off). Only a wrong password counts.
  • The number of password checks running at the same time is bounded (default 8), so a flood of
    sign-ins can no longer exhaust the heap. A sign-in which finds no free slot is refused and not counted.
  • The 5-failures-per-user limit is checked and counted in one step, so parallel requests cannot try
    more passwords. It now also applies to LDAP admins and LDAP Company Portal users. An outage of the
    back-end or the LDAP server no longer counts as a failure.
  • An unknown portal or Company Portal user gets the same slow answer as a wrong password.
  • Signup, password reset and PDF reply links, the system mail HMAC header and TOTP codes are compared
    in constant time.
  • A new admin password must be at least 12 characters and follow the portal rules; a password with the
    system encoding (machine accounts) at least 32. Alphabetical sequences (abcde) are refused like
    keyboard sequences already were. Existing passwords are not affected.

Admin access

  • The IP addresses an admin is restricted to are checked on every request. A session ends when a
    request comes from an address that is not on the list.
  • Only the loopback address may set X-Forwarded-For. Behind a trusted proxy, a client with a private
    address could claim any address.
  • The permission of a property is checked before its user or domain is looked up, so an admin without
    the permission can no longer enumerate users and domains.

OpenID Connect and Entra ID

  • A login is refused when the provider says the email address is not verified. On by default for the
    Company Portal, off for the admin.
  • An Entra ID login to the Company Portal requires that Entra ID verified the domain of the email
    address (xms_edov claim).
  • The administration guide now finds Entra ID admins by object ID (oid), and the bug that broke a
    login on an ID-token-only claim is fixed.

Mail processing

  • The subject filter is applied to the protected subject of a PGP/MIME or S/MIME message, so a sender
    can no longer add a tag such as [signed] through the protected header.
  • At most 10 signers of an S/MIME message are checked, and a signer whose signature does not verify is
    not trust-checked.
  • A line break hidden in an encoded word can no longer be used to inject headers; it becomes a space.
  • No PDF password and no portal signup is created for a recipient address that is not valid for the
    gateway (goodbye invalid@invalid.tld).

Portals and Webmail Messenger

  • Uploads are not read before the login, and are limited: 50 MB portal, 1 MB Company Portal, 100 MB
    admin, 5 MB portal forms (configurable).
  • Only images with a cid: or data: address are shown. A relative address could be used to mark
    another message as read and send its read receipt.
  • A message is marked read, and its read receipt sent, by an explicit request after it is displayed,
    not when its body is fetched.
  • A portal user can send 10 Webmail messages per minute and 200 per day (configurable).
  • Failed PDF replies count against the reply limit of the link.

Other changes

  • security.txt (RFC 9116) can be served from /.well-known/security.txt (ciphermail_ui__security_txt).
  • The default Content Security Policy gains frame-ancestors 'self', base-uri 'self' and object-src 'none'.
  • ciphermail_ui__ssl_signature_algorithms sets the TLS signature algorithms, for example to stop
    SHA-1 under the LEGACY crypto policy.
  • Cockpit can be bound to an address, and ciphermail_ui__additional_config adds httpd configuration
    for every web UI (with an Azure Front Door example in the guide). The playbook runs httpd -t before
    replacing the running configuration.
  • UI: input labels are linked to their fields for screen readers, many translations fixed, sidebar logo
    size and alt text are brandable, clicking the active menu item reloads the page.

Read this before upgrading

  • Re-check the admin IP address lists. 10.1.2.5/24 is now the whole /24, an IPv6 address is one
    host and no longer its /64, and an empty entry or a bare prefix length is refused. An admin whose list
    holds only empty entries cannot sign in until it is fixed (auth admin ip-addresses clear with the
    local cli admin).
  • X-Forwarded-For is trusted from loopback only. If your web server connects to a back-end from
    another address, extend ciphermail_*__remoteip_internal_proxies, and remove any
    server.tomcat.remoteip.internal-proxies entry from *__user_defined_system_properties.
  • Company Portal with OpenID Connect: logins with an unverified email address are refused by default.
    A Keycloak with LDAP-federated or brokered users marks every address unverified unless “Trust Email”
    is on. With Entra ID, add the optional claims email and xms_edov to the ID token, or every login
    is refused.
  • Webmail REST clients of your own: GET /api/webmail/getBodyAndAttachments no longer marks the
    message as read. Call POST /api/webmail/messageDisplayed after showing it.
  • The web UI bind addresses must be IP addresses. httpd now listens only on the configured address
    and does not start when a host name does not resolve to the machine.
  • ciphermail_backend__remote_pdf_otp_header and ciphermail_backend__remote_webmail_header must be
    plain header names, or the gateway does not process mail.
  • An override of ciphermail_ui__csp should add the new directives itself.
  • /api/user/getUser (CLI user get) answers 404 for an unknown user instead of an empty 200. Use
    isUser (user check) to test for existence.
  • Permissions that could never be used (portal password, 2FA or OTP secret at domain or global level)
    are removed. Existing roles keep working; setting a list that contains one is refused.

Full details: Email Encryption Gateway release notes - CipherMail Email Encryption