Skip to main content
Sign in
Deutsch Español Français Italiano

Libraesva ESG v4.7: Release Notes

Changes in v4.7.12 (Apr 12, 2021)

Security

  • Undisclosed security fix (thanks to Daniele Barattieri – Ethical Security for the responsible disclosure)

Changes in v4.7.11 (Jul 17)

Bug Fixes

  • Office 365 User Import: Fix memory allocation during import
  • User Import: fix import when there are usernames with special or non-printable characters

Improvements

  • Added Reboot button after “System Resources” changes

Changes in v4.7.10 (Jul 7)

Security

  • Fix SQL injections in Report page

Bug Fixes

  • Distributed Setup: fixed push of SMTP Policy Quota configurations

Changes in v4.7.9 (May 12)

Security

  • URLSand replace of URL in text part has been highly optimized (at least 10x faster)
  • Quicksand recognise a new branch of XML Macros

Improvements

  • Improved UI for Authentication results protocols in messages details (i.e. SPF, DKIM, DMARC, SMTP-Auth, Trusted networks)
  • Relay test improved to test Dynamic verification
  • More efficient disaster-recovery procedure on quarantine disk full
  • Quarantine replica monitor will promply notify admin of anomalies
  • Improved whaling functionality description

Bug Fixes

  • Relay test honor the MX flag in configuration
  • Delivery of quarantine reports correctly handles email address with special chars (e.g. multiple @ signs)
  • Anti-spam optimizer supports rules with special/invalid UTF-8 sequence
  • Resoved an issue with rebalancing of Adaptive Trust Engine which prevented some message release
  • Summary report add missing SMTP reject types (e.g. DNS Recipients)
  • Regression in report filtering by MCP has been solved

Changes in v4.7.8 (Apr 21)

Security

  • Fix SQL Injection in Attachment Filters page (thanks to Eng. Basim Alabdullah for the responsible disclosure)
  • Intercept new branch of encrypted Microsoft documents
  • Quicksand integration with antispam is now able to block email with encrypted documents
  • TLS policy are correctly saved for route like [mail.srv.test]

Improvements

  • Block email with attachment blocked can now be overridden by single email relay
  • Submit as Good/Bad report includes JSON+LD data and use the quarantine digest template
  • Added more logging and benchmark for Quarantine digest report
  • Balance upper limit for MTA processes on small systems

Bug Fixes

  • Fix duplicate license count with O365 when username and primary email address are different
  • API: restore backward compatibility for addLdapSet

Changes in v4.7.7 (Mar 19)

Security

  • Blocks IQY files by default
  • UI: Remove dangerous and superseded action “Delete ALL” from queue management
  • UI: authenticate user before serving image caches

Improvements

  • Notify user about the delayed reload of the license after upload
  • Improve web UI for mailbox usage page
  • Don’t notify cluster minor issues when auto-recovery is successful
  • API: added new filters subject, from and quarantined to message list call
  • Refactored many rsyslog messages, most notably QuickSand and Whaling
  • Remote support: new debug mode allows for deeper inspection of mail engine analysis

Bug Fixes

  • Report: fix saving and restore when there are multiple filter conditions on the same datasets
  • Prevent PID file cleanup by spurious MailScanner service check
  • URLSand: avoid very long line after HTML substitution
  • Remove spurious snmpd logging when outgoing queues are empty
  • Don’t overwrite let’s encrypt cert when migrating to wildcard certificate
  • Add benchmarks for quarantine reports in cron logs
  • Logwatch: add QuickSand, Whaling, TNEF and improve ClamAV and SpamAssassin
  • Licensing: only count the main address as mailbox in O365
  • API: properly initialize message properties for URLSand and Quicksand

Changes in v4.7.6 (Mar 10)

Security

  • Adaptive Trust Engine use per domain history size, to increase security in MSP appliance
  • Bayes engine track originating username in audit log instead or generic “system”
  • Uniform bayes learning capabilities across domain admins
  • Autoban IP trying to brute force O365 JWT authentication

Improvements

  • Adaptive Trust Engine learn known senders from release actions
  • Log all fail2ban actions in remote syslog
  • Faster dashboard loading time for cluster and queue status
  • Improve ESG self-updating script to be more responsive when handling incident response

Bug Fixes

  • Properly configure OEM antivirus after license change
  • Recover Let’s Encrypt certificate renew under some configuration
  • Use simpler (and slower) LDAP queries for LDAP “OTHER” types, to increase compatibility
  • Prevent configuration errors, when all TLS policies are removed

Changes in v4.7.5 (Mar 3)

Security

  • Quicksand intercept new category of autostart macro in Microsoft Documents

Improvements

  • Use CIDR notation in SMTP Check Override
  • distributed setup monitor all configuration changes in web UI
  • Adaptive Trust Engine web UI huge speed improvements (up to 90% faster)
  • LDAP/O365 import jobs only run on master nodes
  • O365 import use parallel requests to improve import times

Bug Fixes

  • recover ability to disable Graymail plugin
  • avoid slow replication on huge valid recipients import
  • distributed setup monitor properly show queue out values
  • distributed setup monitor show UI indication on successful propagation
  • correctly restore rsyslog configuration in distributed setup
  • disable automatic start of Account Takeover Protection if included in license
  • prevent duplicates domain in SPF exception

Changes in v4.7.4 (Feb 21)

Security

  • Domain-admin cannot release potentially spoofed email (i.e. sent from his domain but from untrusted source)
  • Bayes learning manual actions from UI require admin level
  • Introduce a timeout in Quicksand pre-analysis
  • Hide scheduled reports from read-only administrators

Features

  • New user type: Quarantine Admin
  • New user type: Read-only Multi-domain Admin
  • New user type: Quarantine Multi-domain Admin
  • New user type: Quarantine Domain Admin

Improvements

  • Speedup Quicksand analysis of macros
  • Speedup Quicksand analysis of PDF with many links
  • Submit as Bad/Good cannot be made by read-only administrators
  • Hide unauthorized actions in message detail page
  • Add more detail to quarantine test page
  • Allow quarantine digest for read-only adminstrators
  • Reduce default number of Engine core to 2 * n-CPU
  • Enable O365 groups synchronization
  • Reduce logging of SNMPd sent via rsyslog
  • Default date ranges in search page is a day or a week depends on database size

Bug Fixes

  • Prevent SQL syntax errors in user manager page
  • Limit TLS logging to normal or verbose level
  • Message recall from Exchange 2010 SP3 no longer returns XML validation error
  • Disable VM-resize of Libraesva cloud appliances
  • Don’t show “already released” warning on first release action
  • Validate hostname with numbers in First Install Wizard
  • License count doesn’t fail on duplicate utf-8 records

Changes in v4.7.3 (Feb 12)

Security

  • Fix ownership check of whitelist and blacklist when SafeLearn is enabled
  • Prevent named anchor in email to trigger URLSand warning

Improvements

  • Show a more friendlier message when login is rejected by unauthorized network login
  • Allow to set quarantine enabled in bulk digest option changes
  • List mail in active queue as outgoing
  • More reliable text import of valid recipients
  • Bayes engine changs are applied in batches and nicely
  • Remote support is kept up on reboot, unless stopped by WebUI
  • Remove dangerous delete all options from valid recipient list from text import
  • Pause Incoming Mail exception for 127.0.0.1
  • Properly log dictionary rules as such (not as generic MCP)

Bug Fixes

  • Fix delete message in Email Continuity
  • Check service scripts use locking mechanism
  • Fix output results on WebUI and log properly the user
  • EWS: removed check to limit one TR connector per domain
  • properly check FQDN hostname in wizard
  • Remote support connection not working in some circumstances
  • Cleanup temporary data after FTP backup
  • API addLdapSet – align mandatory params with WebUI
  • UI: Hint for default External Warning exceptions

Changes in v4.7.2 (Feb 6)

Security

  • Phishing highlight use faster Libraesva CDN
  • Intercept new macro malware variant as suspicious in Quicksand
  • Disable insecure TLSv1 TLSv1.1 on HTTPS

Improvements

  • Timeout for password reset reduced from 1 day to 1 hour
  • Improved auditing and internal logging for passwordless authentication
  • Add URLSand Whitelabel in Email Continuity

Bug Fixes

  • Workaround LDAP filters limitation on Domino servers to recover user import
  • Passwordless authentication preserve target page on login
  • External Warning duplicate check
  • Fix Spam action convert to attachment
  • Properly use quarantine host URL instead of hostname for some release links
  • Preserve user source from Check parameters in User Class setters
  • UI: dashboard memory gauge now is accurate even with fractions of GB
  • UI: minor fix javascript actions in detail pages for IE11
  • API: allow API login when password contains special chars
  • Deprecated user API: restore editing of whitelist and blacklist

Changes in v4.7.1 (Jan 23)

Security

  • Whaling Protection: handle non-standard From headers containing Whale-name in mixed case

Improvements

  • Asynchronous bayesian learn after message release from digest report
  • Better interface for Bounce messages in the Details page
  • Update Logwatch rules

Bug Fixes

  • License Count: properly ignore address of deleted domains
  • User Management: fixed bug in detection of duplicated usernames
  • User Management: column sorting by username restored
  • Whaling Protection: fixed bug in web UI that prevent new Whale creation
  • URLSand: fixed bug which prevented the service to be disabled

Changes in v4.7.0 (Jan 3)

Features

  • Adaptive Trust Engine: analyze sender/recipient trust and relationship
  • User Management: Support Read-Only administrator and domain administrator
  • Impersonation Protection: new “External Warning” banner to identify external first time senders
  • Cofense (PhishMe) Triage integration: submissions of false-positive and false-negative, will auto-train the engine
  • Outlook Add-In: completely rewritten, available as native Microsoft Add-In
  • Outlook Add-In: toolbar button to directly submit false-negatives to Esvalabs
  • Mobile App: completely rewritten, available for IOS and Android, added Email Continuity
  • Email Continuity: URLSand protection is active for each shown email
  • Email Continuity: allow sending of new email
  • Email Continuity: full scan of email generated on the WebUI
  • URLSand: support for white-labelling of scan pages (license needed)
  • LDAP configuration: main address used for quarantine report and licensing is now freely configurable
  • Email notification: new HTML templates for many automated notifications (license, services status, …)
  • Account Takeover Protection: new “Access Control” policies allow more fine-grained sender/recipient rejection policy
  • New Remote Support: give feedback on connection enabled, and allow for connection on port other than 25
  • Hyper-V: automatic updates of guest tools
  • SNMP: in cluster environment, allow for distinct configuration on each node

Security

  • New authentication and authorization system, with support fine grained capabilities and roles
  • Login: CSRF protection on all logins
  • Password Recovery: integrate with passwordless-authentication when applicable
  • Password Recovery: use one-time-password for recovery
  • Passwordless Authentication: rewritten to seamlessly integrate in the WebUI
  • Passwordless Authentication: only use HTTPS to increase security
  • Transport Layer Security: Let’s encrypt auto-renewing certificate can now be used also for SMTPS
  • DNS: primary DNS is no longer editable, to avoid common misconfiguration which results in severe security issues
  • Antispam Engine: spam check can now be applied to the whole email, honoring MTA limits in all circumstances
  • Quicksand: dangerous email can now be flagged as infection to prevent users accidental release
  • Libraesva Update: new distribution system, which support transactions and CDN deployments
  • Quicksand: maintain distinct categorization for ZIP archives and contained sanitized PDF.
  • WebUI: separate session for HTTP and HTTPS to improve cookie security
  • URLSand: refactored code to support replacements of all text-links in HTML
  • Attachment Filters: blocks many new extensions by default (e.g. crt, perl, python, …)
  • User interface: user capabilities on a message are checked for every action in quarantine and WebUI
  • Recall action now shows whether the user has read the email before it was recalled

Improvements

  • DKIM: allow to export public keys
  • Maillog viewer: allow downloading of previously rotated logs
  • SMTP Policy Quota: renamed to Account Takeover Protection for consistency
  • Impersonation Protection: incorporate “Whaling” protection and “Phishing Highlight”
  • HTTPS: automatically enable “force SSL” option after Let’s Encrypt certificate generation
  • Reports: allow filtering by Trusted source
  • Dashboard: new gauges shows all system resources and usage
  • Dictionary: find triggered words in message details
  • Spam Report: find domain which trigger malware or graymail rules
  • HTTPS: show relavant certificate details
  • SMTP TLS: show all relavant certificate details
  • UI: modernize button styling
  • Dangerous Content Release Override removed (superseded by user capabilities)
  • Passwords: require that password are at least 8 chars
  • Advanced settings: full-whitelist can now be configured as “antivirus only”
  • Improved database performance and reliability of: whitelist, blacklists, user manager, geolocation, user tokens, quarantine delivered, first time senders.
  • License: use incremental counting to speedup nightly jobs
  • SPF: updated deamon to latest version and added diagnostic page spf.libraesva.com
  • New internal monitor for HTTPS service availability and recovery
  • Mail Encryption: sensitivity header detection is off by default
  • Message Details: added many rules descriptions
  • Message Details: highlight email received from trusted sources (network or SMTP-Auth)
  • Message Details: show whaling rule at top in spam reports
  • Message Details: add link to search attachments hash on VirusTotal
  • Message Details: improve mail details header
  • Message Details: shows signatures validation and notable headers
  • New quarantine disk monitor with better prevention of disk exhausted
  • Whitelabel: remove Libraesva prefix from user pages
  • Whitelist/Blacklist: automatic initialization of “Check Only From Envelope” based on user context and permissions
  • Authentication test: clear output from authentication logs
  • Web UI: added templates for HTTP exceptions
  • API: searchMessage supports more types
  • API: add userId and/or email to ReleaseMsg

Bug fixes

  • Whitelist/blacklist: cleanup empty data from DB which may interfere with analysis
  • Attachment warnings: implemented workarounds for Apple Mail visualization bugs
  • Attachment Filters: allow longer filename extensions
  • Distributed Setup: fix DKIM keys permissions on replication
  • Domain import: initialize URLSand/QuickSand configuration
  • Score Normalization: fix counting of normalization history
  • Message Details: better highlight for GRBL and URI_DOMAIN rules
  • UI: refer to “Infection” instead of “Virus” where appropriate
  • Quarantine: permission monitor scans quarantine multiple times per hour
  • MTA advanced: myhostname validation make sure that simple domain name are not used
  • Valid Recipient List: better cleanup and validation of email address
  • LogWatch: mail from and mail to are aligned with system preferences
  • Custom spam rules: prevent creating rules with invalid names
  • SMTP Auth: remove warnings about duplicate records
  • Rsyslog: increase rate limiting to prevent packed drops
  • SMTP Reject: properly log dynamic verification failures as recipient unknown
  • SMTP Reject: properly log some new SPF failures log
  • Cluster monitor: when resetting make sure to flush all isolated hosts
  • Firewall Checks: add more return codes analysis to improve reliability
  • User import: honor white labelling in email template
  • SystemHealth: properly check for ClamAV signatures updates
  • URLSand: skip domains .local and .intranet
  • LocalRBL: removed debug logs
  • Branding: aligned the product name to Libraesva ESG
  • API: stabilization of getmaillog and getspamlog