Table of Contents
Changes in v4.9.29 (Oct 26, 2023)
Security
- ClamAV: upgrade to version 0.103.11
Changes in v4.9.28 (Aug 29, 2023)
Security
- ClamAV: upgrade to version 0.103.10
Changes in v4.9.27 (Mar 13, 2023)
Security
- QuickSand: block attachments in archive when unzip size is greater than 150MB
Changes in v4.9.26 (Feb 21, 2023)
Security
- ClamAV: upgrade to version 0.103.8
Changes in v4.9.25 (Oct 17, 2022)
Security
- Improves RBL detection sub-domains below 3rd level
- Quicksand: improves www-links detection in PDF
- Update Bitdefender license
Bug Fixes
- Oulook add-in: remove reference to a deprecated API call
Changes in v4.9.24 (Sep 05, 2022)
Improvement
- Add forward compatibility for Clamd configuration of ESG 5.x
- ESG5 migration: avoid using special or hard to read chars in password
Bug Fixes
- Export no longer generate errors if executed by read-only or quarantine admins
Changes in v4.9.23 (Aug 08, 2022)
Security
- Quicksand: identify suspicious action write+execute without autoexec
- ClamAV: upgrade to version 0.103.7
Improvement
- Update file type recognition database (Improved detection of executable files)
Bug Fixes
- Let’s Encrypt: change preferred Root Chain to “ISRG Root X1”
Changes in v4.9.22 (Jul 19, 2022)
Bug Fixes
- Fixed removal of Passwordless Authorized Devices
- Properly reset permission before create ESG 5.x migration file
Improvement
- upgrade page: added link to the official upgrade guide to version 5.x
Changes in v4.9.21 (Jul 4, 2022)
Security
- Defend against file extension evasion techniques targeting Windows machines
Bug Fixes
- Quarantine page: fixed the algorithm that calculates the range of dates shown by default
Changes in v4.9.20 (May 23, 2022)
Improvements
- Stop MailScanner Engine and schedulated task before create ESG 5.x migration file
Bug Fixes
- Remove Unsupported mechanism CRAM-MD5 from SMTP Auth LDAP
- Valid Recipient List import: prevent duplicated addresses
- Search: properly show outbound messages for Domain Admin Users
- Backup download: increased timeout for big files
- Google Workspace: fixed login when user doesn’t exist yet
Changes in v4.9.19 (Apr 19, 2022)
Improvements
- skip whaling check when scan mode is “virus only”
- Message details: add warning for failed SPF beside whitelist result label
Bug Fixes
- URLSand: always executes HTML analysis, even when preliminary tests have found no A-tags
- M365 Authentication: add openid scope
- whitelist/blacklist: fix validation of IP addresses
Changes in v4.9.18 (Mar 14, 2022)
Security
- protect backups from un-authorized access
- add DNS lookup to esvalabs when IP is blacklisted for DoS attempt
Improvements
- Upgrade Letsencrypt certbot
Bug Fixes
- Smarthost: use most specific configuration when mixing domain based smarthost and default smarthost
- User text import: replace variable HOST URL with value configured in quarantine report
- Quicksand: fix disarming of external resources in office documents
- Upgrade from ESG 4.8: fix a version conflict which may block the upgrade
Changes in v4.9.17 (Mar 02, 2022)
Features
- Country Policies: configurable policies to allow/block web interface access from specific countries (see also Geo-Blocking)
Bug Fixes
- Report: fixed operators for search on Attachments properties
- Viewmail: properly identify attachments filenames if defined in MIME Entity headers
- Threat Remediation: always try the recall for all recipients, and log failure tentative
- Disabled password-less login when domain authentication is configured to “No Access”
- Message Detail: fixed report parsing for Deutsche language
- More reliable reactivation of services/modules when uploading a new license after the expiration of the previous one
Changes in v4.9.16 (Feb 10, 2022)
Security
- ClamAV: upgrade to version 0.103.5 LTS
- Block aggressive bulk email even when Graymail plugin is disabled
- Close PwnKit security issue
Improvements
- Periodical cleanup of unusual values in message score normalization
- Increase “unusual correspondent” interval from 12h to 24h
Bug Fixes
- Include greylist database to ESG 5.0 migrations
- URLSand rewrite: handle & character correctly in HTML text parts
Changes in v4.9.15 (Dec 20, 2021)
Security
- ClamAV SaneSecurity: changed enabled databases based on Libraesva security review
- Passwordless: double check server-side secret on token verification
- Passwordless: stronger encryption routine backported from ESG 5
Improvements
- Add audit log in Account takeover protection
- Disk expansion: warn about possible expansions left
Bug Fixes
- Disk expansion: minimal increase is set to 1GB (to avoid almost null expansions)
- System Upgrade: review upgrade file extract command
Changes in v4.9.14 (Oct 11, 2021)
Security
- Change key-server for OpenPGP verification
Bug Fixes
- Fix listing of “Message Release Requests” for Domain Admins.
- Support UK/US date/time format in Digest report and Reports
Changes in v4.9.13 (Sep 27, 2021)
Security
- block as other infections some ZIP files crafted to DoS attachment analysis;
- resolve DNS timeout issues in Botnet identification.
Improvements
- add QuickSand analysis caching, to speed-up dequeuing of bulk delivery;
- use single-field OTP in WebUI, for better integration with keyring security applications;
- slightly increment antispam engine timeout.
Bug Fixes
- replication of certificates in cluster environment is limited to relay-bounded certificates.
Changes in v4.9.12 (Sep 6, 2021)
Security
- Identify and replace a new class of URI in PDF files.
Improvements
- LDAP/M365/Google import for Valid Recipient/Users now show the name of the connector used.
Changes in v4.9.11 (Aug 2, 2021)
Security
- prevent DoS attack in html parsing, caused by a malformed single huge line of random chars.
Improvements
- update file type recognition database.
- add console command to create ESG 5.x migration file.
- add audit log event for safe learn network.
Bug Fixes
- HTML disarm no longer breaks signatures for outgoing bounce messages
- Message details: restore detailed information in spam reports
Changes in v4.9.10 (Jul 12, 2021)
Security
- oAuth Login: Use encrypted token instead of cookie
Bug Fixes
- Email Continuity: used proper charset on attachments download
- SMTP Auth: fixed cluster replica when there is a myhostname configured
- License Count for O365: fixed the identification of the distribution lists and unlicensed mailboxes
Improvements
- Relay Domain: changed default value for Antispoofing to Standard (SPF)
- Reduced frequencies of system alerts
- API: added an optional parameter “field” to getuseraliases
Changes in v4.9.9 (May 31, 2021)
Improvements
- API: added getFullMaillog
Bug Fixes
- Gsuite: add import of non editable aliases
- Hosts file: correctly highlight “Apply Settings” button after changes
- API `version`: show correct available version
Changes in v4.9.8 (May 11, 2021)
Improvements
- Attachments Filters: allow Dos Device drivers
- Allow message size up to 150MB
Changes in v4.9.7 (May 5, 2021)
Security
- Improved detection of suspicious excel4/xlm macros
Bug Fixes
- Logo & Messages: fix visualization of “Attachments Filters” customization
Changes in v4.9.6 (Apr 21, 2021)
Security
- Installed security updates for Spam Engine.
Bug Fixes
- Fix partial display of queued mails from WebUI.
Changes in v4.9.5 (Apr 7, 2021)
Security
- Undisclosed security fix (thanks to Daniele Barattieri – Ethical Security for the responsible disclosure)
- Whaling Protection: skip whaling checks only when the whale itself is the only recipient
Improvements
- Threat Remediation recall show more detailed information on failure
- SMTP Auth with LDAP: Search Base can be empty (required by Zimbra)
Bug Fixes
- Better management of SSH sessions used for cluster replica
- Fixed “Disable” option of scheduled report
- Fix audit log when user delete a relay domain
- Quicksand: improved detection of link in PDF documents
Changes in v4.9.4 (Feb 9, 2021)
Security
- Quicksand: extend the function to disarm dangerous files inside archives, to all supported archive types (e.g. 7zip)
Bug Fixes
- Trusted Networks: Show/Hide “Manage Hosted Services” based on license properties
- Reload whole engine settings every 30 minutes
Changes in v4.9.3 (Feb 2, 2021)
Security
- Improved detection of embedded objects in rtf files
- Fix SQL injections in Report page
Improvements
- Implement M365/GSuite oAuth login for Mobile Apps
- Allow partial bulk update for Digest Report Options
- Add audit Log events for LDAP/GSuite/Web Portal Authentication
- Cluster Wizard: properly shows errors on database dump/restore
- Message release request are acknowledged on any release action
Bug Fixes
- Cluster Wizard: force “Pre Shared Key” to be withing 8 and 32 chars
- User action Whitelist/Blacklist properly allowed for “Safe Learn” anonymous users
Changes in v4.9.2 (Jan 18, 2021)
Improvements
- Threat Remediation: shows if a message is read when recalling from Message Operations
- Web Portal Authentication: improved warning for incomplete set configuration
Bug Fixes
- Whaling Protection: avoid false positive caused by case-sensitive comparison
- Account Takeover Protection: log all the Message Quota events
- Threat Remediation: fix permission problem of the recall from Message Operations
- Digest Report: restore View button when no other actions are configured
- Domain Relay: fix bulk update of relay Server
- DKIM Signing: Fix multiple deletion of DKIM keys
Changes in v4.9.1 (Jan 4, 2021)
Improvements
- Whaling Protection: use DMARC to validate legitimate whales
Bug Fixes
- Address Rewriting: allow to add the same rewriting scheme for sender and recipient
Changes in v4.9.0 (Dec 29, 2020)
Features
- New Multi-Factor Authentication with T-OTP (time-based one-time-password) is now available to admins and users
- Threat Remediation (recall email messages from inbox) now available also for G-Suite
- Custom TLS certificates can be used to relay email to internal domains. Microsoft365 inbound connectors can be based on the Common Name of the TLS certificate for a complete multi-tenant interoperability.
- URLs rewritten by URLSand can be logged to syslog
- Configurable sender/recipient address/domain rewriting. ESG can transparently replace domains or email addresses.
- Domain Text Import: additional fields are supported by the batch import procedure.
- New API “Mark For Release” is now available
- Add Blacklist link now available in the Digest Report actions
Security
- Updated Content-Security-Policy header
- CentOS security repository migrated to Libraesva Extended Support service
Improvements
- Microsoft 365 Threat Remediation: migrate from EWS to Graph API
- Threat Remediation: Domain Admin/Multi Domain Admin can “Recall” messages from their domain
- Add “Quarantine Report” option to IMAP/POP3 Set
- Users can “Mark for Release” a message also from WebUI
- Additional search options in Password-less Authorized Devices list
- More reliable cluster wizard procedure
Bug Fixes
- Distributed setup: reload license on slave nodes after configuration push
- Preserve hosts file after hostname change
- Properly show hosts file record from WebUI
- Fixed Backup and Restore of DKIM configuration
- Search: fixed a bug that may cause different records to be displayed in message detail
- Custom Spam Rules can be applied also on a single address
- Properly apply “AntiSpam Engine Processes” configuration after change
- Clean exported csv of relay domain from spurious columns