1 Topic by CP (edited by CP Yesterday 21:52:32)

  • CP
  • Member
  • Offline
  • Registered: 2025-07-16
  • Posts: 11

Topic: iRedMail EE on Ubuntu 22.04 and php 8.1 (vulnerable?)

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): iRedMail EE v1.8.5
- Deployed with iRedMail Easy or the downloadable installer? iRedMail EE deployment
- Linux/BSD distribution name and version: Ubuntu 22.04.5 LTS
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MariaDB
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? n/a
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

Hello. Following Critical PHP vulnerabilities announcement , I checked php version on my iRedMail EE installation on Ubuntu 22.04.5 LTS and found RoundCube uses php 8.1 (the default version for v22.04).

Is anyone in the same situation. Any suggestion how address this?

I was thinking to add the 8.3 repository, installing it and changing iRedMail configuration so that 8.3 is used instead of 8.1; but I have no idea if this could interfere with RedMail EE auto deployment.

Long term plan could be creating a new server with Ubuntu 26.04 and migrate mailboxes, but in the meantime? In-place upgrade is out of question.

As of now I closed access to Roundcube from external, to prevent exploiting php vulnerability.

Ideas welcomed.
CP

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by CP (edited by CP Yesterday 21:53:12)

  • CP
  • Member
  • Offline
  • Registered: 2025-07-16
  • Posts: 11

Re: iRedMail EE on Ubuntu 22.04 and php 8.1 (vulnerable?)

UPDATE:
I checked:
https://ubuntu.com/security/CVE-2026-109618
https://ubuntu.com/security/CVE-2026-109619
and php8.1 in 22.04 LTS jammy has status "Fixed in 8.1.2-1ubuntu2.28" (backporting?).

After, I checked my installation with:
dpkg -l | grep php8.1-cli
and it reports:
ii php8.1-cli 8.1.2-1ubuntu2.28 amd64 command-line interpreter for the PHP scripting language

so I think I'm ok for now.

Hope this is useful to anyone in the same guessing situation.

If I'm wrong, please let me know.
CP

3 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,781

Re: iRedMail EE on Ubuntu 22.04 and php 8.1 (vulnerable?)

Just run "apt update && apt upgrade" on Ubuntu machine to update php packages, newer php packages fix the issue.

4 Reply by venzonic

  • venzonic
  • Member
  • Offline
  • Registered: 2021-06-09
  • Posts: 2

Re: iRedMail EE on Ubuntu 22.04 and php 8.1 (vulnerable?)

ZhangHuangbin wrote:

Just run "apt update && apt upgrade" on Ubuntu machine to update php packages, newer php packages fix the issue.


Please confirm if executing this update will not cause any system issues.