Libraesva ESG v5.4: Release Notes

Main features of version 5.4

• Fine-Grained Roles and Permissions: role administrators can define customized roles with precise control over configuration and message permissions.
• New Domain Administrator Access Levels: domain administrators can now have "user management" or "full administration" capabilities.
• Anti-Spoofing for Welcomelist and Blocklist: sender domain authentication results for SPF, DKIM, and DMARC are now used to refine selection of Welcomelist and Blocklist entries.
• User profile: new page for personal information, with support for quarantine digest configuration, password change, and 2FA setup.
• Message metadata: compress and encrypt metadata stored in the database (e.g., headers).
• Valid recipient list: on delete, optionally remove or detach the recipient from all users.
• Avira antivirus: new detailed engine status page with per-domain configurations.
• Bitdefender antivirus: new detailed engine status page with per-domain configurations.
• ClamAV antivirus: new detailed engine status page.

Version 5.4.10 (Dec 9, 2025)

Security

• Antivirus: integrate additional scanning for Microsoft OneNote files and images
• User profile: require OTP to change password or disable two-factor authentication
• Web UI: hardened security by integrating CSRF protection to data grids

Bug fixes

• NTPd: fixed configuration of custom NTP server.

Version 5.4.9 (Oct 22, 2025)

Security

• Web UI: hardened data validation and javascript runtime
• Dashboard: show a warning in dashboard when ESG version is not up to date

Version 5.4.8 (Sep 16, 2025)

Security

• Mail scanner: fixed CVE-2025-59689
• System upgrade: new upgrade system with asymmetric signature validation and encryption
• Passwordless: removed old authentication systems (may need re-login)
• API authentication: removed old authentication systems (may need re-login)
• Remote support: removed the old remote support connection via port 25
• ClamAV: added support for new signature formats via Libraesva updates

Version 5.4.7 (May, 19 2025)

Bug fixes

• Syslog: properly show “TLS Enabled” field when using TCP protocol

API

• FIXED: properly ignore deprecated type/permissions properties when a role is provided in POST /user`/`PUT /user`/`PATCH /user`

Version 5.4.6 (Apr, 28 2025)

Security

• Reset password: do not allow password resets for integration users

Improvements

• Auditing: added auditing of antivirus engine configurations
• Mail transport: improved outgoing SMTP connection throttling (resolves some provider issues, e.g., libero.it)
• Google Workspace: ignore users without fully configured mailboxes
• Google Workspace: import suspended users as functional accounts

Bug fixes

• Antivirus engines: fixed tracking of “apply settings” after enabling/disabling antivirus
• Antispam settings: fixed validation of the “Max Allowed Message Size” setting
• Antispam settings: fixed tracking of “apply settings” after enabling/disabling the plugin
• ATP: renamed “discard” actions to a more accurate “delete (black hole)”
• ATP: fixed database permissions when cleaning old records on a cluster worker
• Backup: fixed backup of custom user roles
• Backup: fixed estimation of required storage before backup
• Cluster worker: fixed job replication from main node to workers during detach
• Cluster worker: fixed API authentication on worker appliances
• Dictionary: fixed deletion of dictionary entries
• Integration: fixed issue when adding group email to users without making other changes
• LDAP: fixed identification of functional users on Exchange 2016
• Logwatch: ignored noisy log entries for wide-chars detected by the whaling plugin
• Mail queues: fixed deletion of messages from mail queues
• SNMP: fixed format of licensing overuse value
• Message actions: allow download if release is granted
• Message details: fixed display of bounce messages without a “From” header
• Password reset: do not allow reset for integration users
• Quarantine settings: preserve selected language upon saving
• Queue cleaner: avoided timeouts when deleting thousands of messages using delete preview
• Queue cleaner: ignore messages with invalid addresses when filtering by sender or recipient
• SMTP-Auth DoS protection: fixed tracking of “apply settings” after changes to trusted networks
• User manager: fixed removal of administrator domains
• User management: fixed bulk update for Domain Administrator users
• User messages: preserve selected language upon saving
• Welcomelist: entries are no longer skipped if an SPF domain exception exists

Version 5.4.5 (Mar, 26 2025)

Security

• Welcomelist: entries are not skipped for DMARC failures with policy set to none

Improvements

• User messages: permit “report as good” link in incoming messages signatures

Bug fixes

• ATP: improved cleanup of old ATP tracker records before listing
• Cluster worker: fixed admin login via Microsoft 365 or Google Workspace
• Custom spam policies: added stricter validation for name, header name and rule match
• Custom spam policies: fixed rules that specify both domain filter and rule match
• Domain authentication exception: fixed audit log format
• Mail Scanner: always block messages with infected content, even if sanitized
• Release request: quarantine domain admins are allowed to release messages
• Release request: avoid UI errors when multiple release requests from different users are handled in bulk
• TLS certificate: fixed an issue that prevented the upload of an existing certificate
• User management: permit editing user role in overuse grace period
• User role: fixed “can list” documentation for Network and API role
• Whaling: fixed detection of attempts in subject header with UTF-8 characters

API

• FIXED: /user properly define the role as an IRI reference
• ADD: added lastSync property to GET /user/GET /valid-recipient
• ADD: property createdAt to GET /blocklist/{id}/GET /welcomelist/{id}
• ADD: property comment to GET /blocklist/{id}/GET /welcomelist/{id}
• ADD: property comment to POST /blocklist/POST /welcomelist
• ADD: property comment to GET /attachment-filter/*/{id}
• ADD: property comment to POST /attachment-filter/*

Version 5.4.4 (Mar, 10 2025)

Features

• Trusted network: added CSV import
• Backup: added S3-like scheduled backup

Improvements

• ATE: improved accuracy of first time sender detection for some bulk sender (e.g. Salesforce, MailChimp)
• Quarantine digest: added option “include delivered”
• Quarantine settings: show user role in test tool
• SNMP: added new license and accounting OID (see ESG inline documentation)
• URLSand: advanced option “remove signed” is applied to non-standard PEC/PKCS signatures
• URLSan: reduced duplicated log entries when domain exceptions are used

Bug fixes

• ATE: fixed subdomain cleanup of envelope sender when storing interactions (fix FTS accuracy regression)
• Blocklist: listing are applied independently of authentication-results
• CSV export: removed spurious trailing comma
• Custom spam policies: fixed delete action
• Message details: don’t add “View body” button unless the user has the “can view body” capability
• Outlook add-in: fixed font loading
• Quarantine digest: don’t add “message preview” link unless the user has the “can view body” capability
• Quarantine digest: include delivered messages if attachments are modified or removed
• Reset password: fixed UI which asked for previous password when resetting
• Storage rotation: update database records when rotating compressed quarantined files
• URLSand: domain exceptions are applied even when a non-standard HTTP port is used
• User spam scores: apply custom scores to messages delivered to primary address, not username

Version 5.4.3 (Feb, 19 2025)

Security

• TLS Encryption: removed TLS1 and TLS1.1 from “Medium” policy

Improvements

• Check firewall: improved detection of firewall inspection on TCP DNS queries
• Cluster status: more compact UI when workers are configured
• Cluster worker setup: faster service reload on main node after setup
• Custom spam policies: added a new custom spam policy field “Rule match“
• Dashboard: better UI when more than four workers are configured
• Distributed setup: suspend cluster also on workers when primary cluster is suspended
• License accounted: added button “Add valid recipient” when accounting is email based
• Queue cleaner: improved search parameters and added preview before removal
• Report: added export in csv format
• System upgrades: improved UI feedback after upgrade or in case of failures
• System upgrades: support version upgrade for distributed setups
• System upgrades: synchronize time of nodes before upgrade

Bug fixes

• Custom score: avoid server error when value is exactly “'0'“
• License accounted: added button “Right to be forgotten” when accounting is email based
• MSSP instance monitor: fixed license upload to managed appliances
• NTP: fixed conditional reloading on apply settings
• Smarthost relay: fixed relay to port 465 (SMTPS)
• System logs: fixed conditional reloading on apply settings
• User management: fix bulk update of OTP mandatory option
• User manager: avoid server validation errors when changing custom scores
• View mail: properly show correct filename of attachments (regression of 5.4.2)

API

• ADD: manage LDAP tenant groups via /integration/ldap-tenant-group
• ADD: added hostname/type/bindUsername/fallbackHostname property to GET /integration/ldap
• ADD: added hostname/type/bindUsername/fallbackHostname/bindPassword property to POST /integration/ldap

Version 5.4.2 (Feb 3, 2025)

Improvements

• Apply settings: apply scheduled pending changes for timed out jobs
• Integration: added email notification of stale users/valid recipients
• HTTPS: support all DNS names defined in a multiple CN (SAN) certificate
• NTP: added alternate ntp server
• MSSP Monitor: permit to configure a custom port for monitor
• Quarantine digest: exclude delivered messages from reports
• User messages: added UI hint for specific variables of mail intercept and mail encryption
• View mail: show a fallback name for message/rfc822 attachments
• User management: allow bulk update of functional users

Bug fixes

• Backup: changed label “Status” with “Completed” to avoid ambiguities
• Cluster worker: prevent add/delete relay from worker nodes
• Digest report: don’t prepend appliance name to subject
• HTTPS: use strict host validation when using externally generated certificates
• Mail intercept: fixed variable substitution in default Italian template
• Mail logs: fixed database logging of scanned messages with too many attachments
• NTP: track apply settings after server address change
• Relay delivery test: dynamic verification uses relay server when verification server is not set
• Right to be forgotten: fixed job execution
• User management: fixed user role bulk update
• Welcomelist/Blocklist: fixed domain admin import

Version 5.4.1 (Jan 20, 2025)

Security

• Cluster setup: use ED25519 instead of RSA

Improvements

• Auditing: improved account takeover configuration logging message.
• FTP backup: storage messages are exported as incremental daily backup
• FTP backup: allow custom filename format for remote backup
• User messages: added import/export feature
• Web portal: added configuration to completely disable access to the API

Bug fixes

• Auditing: prevent audit log of unchanged configurations
• Change network: avoid double reconfiguration of static hosts
• Change network: fixed configuration of network interface without gateway
• Antispam custom rules: fixed validation of custom regular expressions
• Dictionary: fixed detection of words in Arabic language
• First run: preserve manual configuration of secondary network interfaces
• FTP backup: restrict validation for server configuration
• FTP backup: greatly reduce local storage requirements for FTP backup
• Integration: fixed a bug that blocked import after the rollback of an invalid user
• Licensing: fixed the computation of overuse days
• Local RBL: fixed reload of new allowed/blocked IPs
• Mail queues: restored detail button for outgoing messages
• Mail logs: cut spurious sender/recipient addresses greater than 254 chars to fit in database records
• Attachment filters: fixed generation of attachment warnings for removal
• Menu: fixed relay search for Domain Admin with domain features
• Release requests: fixed creation and notification of message release requests
• Report to labs: fixed action for main role user and network
• Summary report: clarified that deferred messages are not included
• User actions: fixed message actions for users with role networks
• User default config: fixed view and editing permissions for domain administrators
• User role: fixed setting of "Not allowed" for email continuity permissions
• User role: fixed setting of "User preferences only" to Domain Administrator main role

Version 5.4.0 (Dec 23, 2024)

Security

• Blocklist: ignore explicitly welcome listed recipient when looking for blocklists
• TLS Certificate: allow uploading certificate using EC (Elliptic Curve) algorithms
• Welcomelist: disable welcome lists when sender's is spoofed based on SPF/DKIM/DMARC
• Welcomelist: only activate welcome list behaviour if all recipients are explicitly welcomelisted
• Whaling: improved identification of legitimate delivery using SPF/DKIM/DMARC

Improvements

• CSV import: handle BOM in uploaded files.
• Email continuity: enable or disable the feature based on roles and capabilities.
• Email forward: by default, disable email forwarding when user permissions don't include "release".
• External warning exception: added creation date (retro-compatibility provided by audit log).
• Firewall check: moved page under "Admin area > status".
• Integration: functional and normal users can now have different default permissions.
• LDAP Integration: allow passwords up to 254 chars.
• Login test: deny access to "login test" page for quarantine and read-only administrators.
• Mail intercept exception: added creation date (retro-compatibility provided by audit log).
• Mail scanner: added support for Microsoft BATV address format (e.g., msprvs1).
• Mail templates: use username as fallback for empty full names.
• Quarantine report: automatically add "message preview" link if the user has login capability.
• Relay: renamed "group tag" column to "comment" and extended it to 1024 characters.
• Roles: added "Role Appliance Manager" for changing appliance configurations.
• Roles: added "Role License Manager" for modifying license information.
• TLS Certificate: support uploading of externally generated certificates without CSR.
• User manager: removed obsolete "User can change spam settings" option.
• User messages: allow usage of almost all variables in all contexts.
• Web UI: added "multi delete" and "Save and new" on many pages.
• Web portal: allow creating custom users with disabled login for tracking licensing and reports.
• Welcomelist/Blocklist: added creation date (retro-compatibility provided by audit log).
• Welcomelist/Blocklist: support BATV tag removal before lookup.

Bug fixes

• Auditing: ensured logged "old raw" data reflects the persistent original data.
• Message details: renamed "SPF Error" result to "SPF Failed" for clarity.
• Search: limit export to 10k records to avoid long execution times.
• User messages: fixed mail signature replacements when backslashes are used.

API

• ADD: added POST /appliance/apply-settings to apply configuration changes.
• ADD: added POST /message/{id}/report-as-good and POST /message/{id}/report-as-bad
• ADD: property comment to /relay/{id}
• FIXED: GET /licensing/accounted-email won’t list automatically discounted licenses
• DEPRECATED: properties aviraEnabled/bitdefenderEnabled/clamavEnabled o /antispam and /antispam/{id} pages always return false.
• DEPRECATED: property grouptTag of /relay/{id}, use comment instead

Breaking changes

• Licensing: appliances exceeding the licensing quota may experience limited editing functionality. Please ensure your accounting information is up to date before proceeding with the update.

Version 5.3

All upgrades from previous versions are included. See the full release notes of Libraesva ESG version 5.3.