Libraesva ESG v5.1: Release Notes – LibraCyber - Help Center

Table of Contents

Main features of version 5.1

Users with quarantine action "release-only" or "none" cannot manage white and black lists in the UI anymore
Cluster: added replicate transport option for each domain (previously known as WAN cluster or Geo-Cluster option)
Any trusted network defined by the administrator can be configured to accept only email originated by internal domains
Outbound email traffic from Microsoft 365 and G Suite allows only email originated by internal domains (i.e. relay table)
New administrative REST API (/api/v2), stateless, JSON/HAL based, with support for Impersonation and OTP
Quarantine digest report: email addresses of other recipients are not listed for privacy protection
More granular management of the privacy password to view sensitive data
Message details now includes all URIs contained in the message and forensic data about them
Show asynchronous job status and failures to administrator on the Web UI
DMARC aggregated reporting can be enabled by the administrator
Advanced Audit log which contains all the details of the modified data

Version 5.1.20 (Sep 16, 2025)

Security

Mail scanner: fixed CVE-2025-59689
System upgrade: new upgrade system with asymmetric signature validation and encryption
Passwordless: removed old authentication systems (may need re-login)
API authentication: removed old authentication systems (may need re-login)
Remote support: removed the old remote support connection via port 25

Version 5.1.19 (Jul 31, 2024)

Security

Bitdefender: update to version 3.7.1
Savapi: update to version 4.15.22

Version 5.1.18 (Mar 5, 2024)

Security

ClamAV: upgrade to version 0.103.11
Bitdefender: update to version 3.5.5
Savapi: update to version 4.15.20

Version 5.1.17 (Aug 29, 2023)

Security

ClamAV: upgrade to version 0.103.10

Version 5.1.16 (Aug 21, 2023)

Security

Quicksand: add RAR archive reconstruction on sanitization
ClamAV: upgrade to version 0.103.9

Version 5.1.15 (Jun 27, 2023)

Improvements

System Upgrade: show more details on failure

Bug fixes

Microsoft 365: case insensitive username check on login

Version 5.1.14 (Apr 8, 2023)

Security

Savapi: update to version 4.15.16
Bitdefender: update to version 3.2.2

Improvements

Learn Actions: always update Adaptive Trust Engine when learning as good or bad

Bug fixes

SubmitToLabs: when submitting as bad, use learn-as-bad instead of forget
Quarantine reports: allow actions from quarantine report for read-only admins with “mark for relase” permissions
ESG 5.2 upgrade: pre-install the upgrade file for user convenience

Version 5.1.13 (Apr 3, 2023)

Improvements

Audit log: speed up logging during massive updates

Bug fixes

Removed duplicated default/relay configuration
Search: fixed export of search results when using advanced filters
System Preferences: added validation of NTP server address
Digest report: show links of configured actions for “Quarantine” users
Report: fixed MTA Statistics report using advanced timing
System Upgrade: keep local DNS resolved running during system upgrade

Version 5.1.12 (Mar 13, 2023)

Security

QuickSand: block attachments in archive when unzip size is greater than 150MB

Improvements

System Upgrade: require confirmation before upgrade

Bug fixes

File System Replica: improved stability for “Large” appliances
Message Viewer: hide Whitelist/Blacklist action for user with “Mark for Release” permission
Smarthost: fixed migration of 4.9 configuration on address-based smarthost

API

IMPROVED: `message-journal` reduced pagination to 150 records

Version 5.1.11 (Feb 21, 2023)

Security

ClamAV: upgrade to version 0.103.8

Improvements

TLS Certificate: validate certicate match with private key
Fail2ban: ignore SASL auth failed from trusted networks
ClamAV: increase timeout of signature update for slow connection

Bug fixes

Backup: fix backup of TLS Certificates
Database rotation: restore optimization of TxRep data
Graymail Management: add validation on Blocked Graymail entries
Top Sender Report: fix visualization of locally generated email
Quarantine storage extension: fix GPT partition extension
Search: fix “Last Hour” range to latest hour
Report: increase timeout of PDF generation
Message Details: fix popup of Dictionary rules triggered
User Quarantine schedule: automatically order delivery and fixed duplicated hours

Version 5.1.10 (Jan 16, 2023)

Security

Whaling Protection: verify SPF alignment before whaling checks

Improvements

Check Firewall Ports: added detection of firewall inspection on http/https
System Upgrade: implemented email notification after upgrade
System Upgrade: improved check of upgrade pre-condition
License Details: show contact email
Dashboard: show all engines as “not active” when license is expired

Bug fixes

Privacy Password: permit view for Read-Only Domain Admin
Privacy Password: fixed UI regression of version 5.1.9
Antispam action: fixed compile of High Spam forward rule
RBL Filtering: re-activated RBL check flagged as enabled
System notification: use absolute URL for generated email
Database Rotation: fixed cleanup of old Message Uris
Message details: show meaningful messages in pop-up when there are no results
Mail log: properly log to database messages with more than 300 blocked files
Search: fixed condition for all fields with value Yes/No

Version 5.1.9 (Dec 20, 2022)

Improvements

Dashboard Cluster status checks both nodes
FTP Backup: less disk space required before FTP upload
FTP Backup: execute on both nodes of cluster
Updated DDoS default limit for connection and message rate
DMARC: changed reporting organization to appliance hostname

Bug fixes

Quicksand: fixed sanitization of nested archives
Cluster: fixed option “replicate transport” for some instances
Cluster: fixed notification of file replica down
Message Details: show correct DKIM information when domain use mixed case sensitivity
MTA Certificate: correctly apply fallback self-signed certificates
FTP Backup: check disk space before execution
Web UI: custom pagination detail when there are no records
Microsoft Azure: add agent server IP to trusted IPs in firewall configuration
Microsoft Azure: changed keepalive settings to avoid stale support connections
Privacy Password: hide spurious read-only records from Domain Admin view
ESG4 migration: correctly configure CRM114 permission
ESG4 migration: check let’s encrypt configuration before migrate

API

ADD: added validation and other options to `/relay`
FIXED: avoid 500 error on `/relay` updates due to auditing issues of impersonated users
FIXED: avoid 500 error on `/integration/imap` and `/integration/pop3` updates due to digest report options
IMPROVED: increased allowed memory and timeout for `GET /messages/message-soar`

Version 5.1.8 (Nov 14, 2022)

Improvements

Firewall check: only use local resolver for outbound DNS port test (53)
User console: improved storage speed test
ISP Panel: add accounted email addresses count
License Usage: add more fields to exported data
Login auth test: show logs from all user providers (M365, IMAP, …)
Cluster auto-recover: added new auto-recover scenarios
Integrations: when import is triggered from the UI, forward the request to the primary node
Message details: contextualize WebUI notice for ignored whitelist entries
OpenDMARC: don’t replicate data between node so that reports are appliance based.
RSyslog: increase rate limit to 2048 to accomodate large appliance
Cluster: add the replica node to trusted IPs by default
Add support for Enterprise Linux 8.7

Bug fixes

Summary Report: date interval extremes are now included in date range
Improve reliability of watchdog scripts notifications
Microsoft 365 auth: catch server errors when the connector is badly configured
ESG4 migration: correcty migrate disabled antivirus customizations
firewall: maintain netfiltering rules during cluster setup
Fix audit message on TLS certificate deletion
Use correct DN on user import
Backup: added SMTP Auth users to archive
Antispam settings: fix saving of high spam score
Fail2ban: recover logging to rsyslog (as it was in ESG 4.x)

API

FIX: allow creation of relay based entities (regression from 5.1.4 fixed)

Version 5.1.7 (Oct 17, 2022)

Security

Improves RBL detection sub-domains below 3rd level
Quicksand: improves www-links detection in PDF
Update Bitdefender license
Relay: bounce messages sent by M365/G Suite are considered trusted (when the relative option is enabled)

Improvement

Whaling: improved performance of domain selection during scanning
Cluster auto-recovery: reduce timer interval to recover minor error faster
System upgrades: show estimate time in advance and use animated progress bars when upgrade is active
HA Proxy: locally generated email are sent directly, not through the proxy

Bug fixes

Outlook add-in: remove reference to a deprecated API call
User Manager: add JS validation for empty username on creation
User Manager: on user removal, cleanup job statuses owned by that user
UI: remove the about link which conflict with white labeling
Improved trial license upload
Passwordless: remove Libraesva from signature when white labeling is enabled

API

IMPROVED: added user `_permissions` property to message details
IMPROVED: allow domain admins to access `/api/v2` documentation page
FIX: add headers content-type x-requested-with to CORS headers

Changes in v5.1.6 (Oct 3, 2022)

Improvements

ESG 4.x migration: prevent timeout and memory exhaust on historical data restore

Bug fixes

System Definitions: fixed automatic update of blacklisted URL hashes
Release requests: fixed Domain Admin notification of release requests
License Usage: fixed display of accounted license
Login Authorized Networks: properly check login network on current IP before save or modify it

API

FIXED: properly apply page size on GET /message API

Changes in v5.1.5 (Sep 20, 2022)

Improvements

Report: show more data in reports and improve accuracy
Logwatch: reduce noise due to irrelevant log entries
Web UI: menu is collapsible from mobile device

Bug fixes

Message listing: shows to users email sent from restricted trusted network
Message logging: logs URI/attachment with very long names
Message details: fixed negative delay time due to timezone conversions
Summary report: count as outgoing email sent from restricted trusted network
OpenDKIM: always add restricted trusted networks as source for OpenDKIM signatures
Release requests: show disabled form settings to read-only users
Release requests: fixed selection of domain admins for a domain
Backup: hide non-working edit buttons to read-only admins
Backup: increase timeout for TAR command
Whitelist: allow creation of whitelist to SafeLearn network

API

NEW: added /report/{name} methods to query historical data (e.g. license usage /report/per_domain_mailbox_use?search=all)
IMPROVED: collections GET /messages order data by received date
IMPROVED: empty response from POST /user-message return 204 instead of 200

Changes in v5.1.4 (Sep 05, 2022)

Security

Add CSRF protection to all user quarantine actions
Message forwarding requires privacy password authorization
Extended quarantine links validity to 31 days

Improvement

Dashboard: add filtering by “last hour” and “last 3 hours”
Rejected message: show more message details
Search export: added many fields and fixed recipient numbering
Cluster auto-recovery: added notification when the procedure fails to auto-recover
Cluster: improved the auto-recovery procedure when an appliance is powered off for a very long time
Safe-learn web UI: describes advantages and drawback of the feature
Add forward compatibility for Clamd configuration of ESG > 5.1
System upgrades: show estimate time in advance and use animated progress bars when upgrade is active
API user: use automatic password generation to enforce strong password policy

Bug fixes

Backup: restored manual backup creation which was failed due to a missing table
License settings: cleanup license no longer generates memory errors
License settings: restore searching by email address
M365/G suite: resolved a race condition which may interfere with cluster replication
Data Loss Prevention: resolved the 503 caused by custom rule names
Spam Actions UI: add a better description for bounce action
Job status: remove stale job entries when certificate creation fails
Message details: after quarantine storage delete flag the message as “deleted”
Whitelist: fix javascript validation in some complex situation
Login networks: added advanced audit logs
Mail Encryption: auto-apply settings on save
Export no longer generate errors if executed by read-only or quarantine admins
Cofence: fixed auto learn of notified samples (regression from 5.1.3)
Release: show a message to the user when a message release fails
User Messages: show success message on completed save action
First boot wizard: handle non-FQDN before to initial bootstrap is completed
Local RBL: don’t consider quicksand sanitized as definitive threat
Message actions: update all leftover links in user report to the new ESG 5.x format
Phishing safe sites are now mirrored only by Libraesva ESG first-party mirror
Custom spam policy: fix javascript validation for body rules
LDAP import: fix manual import triggered from the WebUI
User manager: fixed saving of option “Can change spam settings”
Release requests: the notification email is optional

API

NEW: read-only access to saved search using “GET /saved-search”
NEW: added resource “/user-message” to allow email-continuity implementation
ADD: added property “senderIp” to message listing “GET /message”
ADD: added many properties to “GET /message/{id}”
ADD: added filtering by recipients and or relay filtering on many resource listing
Increased the default item per page
Improved speed of journal/soar calls when messages contain many URIs

Changes in v5.1.3 (Aug 08, 2022)

Improvements

Privacy password: show session expiration details in profile menu when permission is granted
Reduce web-server memory usage, especially for small appliance
Cluster: auto-recover cluster replication when an appliance is powered off for a very long time
Outlook Addin: added support for “Mark for Release” User Permission

Bug fixes

Clustom Antispam Rule: when adding a rule for a single domain, consider both “envelope to” and “header to” to select the domain
Fix web-interface redirection when DKIM is disabled
Release request: fix auto-removal of already managed requests
Content filtering: removed web-ui combination add custom header on body matches, which isn’t available in the engine
Mail Logs Real-Time View: better visualization for filter and reset buttons
ESG status: remove visualization artifact during status update
Mail Logs Real-Time View: stop real-time view on logout to avoid DoS
System Upgrade: fixed prefetch of all packages before upgrade
Increased timeout for quarantine report generation
Associate delivery to the most recent MTA message id, to avoid issues on high-traffic instances
Automatically apply and reload Mail Scanner configuration when changing Mail Intercept configuration and Attachment Filters
ESG 4.x migration: reset cache after Adaptive Truste Engine import
DKIM Signing: fixed generation of DKIM keys

Changes in v5.1.2 (Jul 26, 2022)

Security

ClamAV: upgrade to version 0.103.7

Improvements

Delivery details: add DSN column
Cluster: allow hostname change when cluster is already setup
Cluster setup wizard: add button to quickly copy-paste IPs
ESG system upgrades: better identification and feedback on Layer-7 inspection

Bug fixes

Adaptive Trust Engine: fixed a bug which prevented the relay age cache to be used
Report: pie chart used in "Per Domain Mailbox Use" defaults to licenses count not email address
Delivery details: delay seconds are displayed correctly
Reports: disabled the menu for raw data export (use export or copy instead)
Cluster setup: show replica IP in flashed message during first initialization
Database logger: fixed a bug that caused some delivery not to be bound to scanned messages
Local RBL: use transactional update to improve accuracy
Queues: ignore temporary files when computing queued message counts
Privacy password: fixed the flashed messages on wrong password
DOS prevention: when an abuser is blocked, prevent access to mail encryption portal too
Backup: ignore a cache table during backup
Cluster reload: added proper distributed reload in many pages
API: boolean property "user releasable" was negated in the output

Changes in v5.1.1 (Jul 20, 2022)

Security

URLSand: handle URI with a protocol name containing special chars

Improvements

Firewall checks includes cluster connectivity check
URI: log all URI also when message is blocked as spam
Quicksand: improve cache hit rate of clean PDF and Documents
User manager: quarantine permissions for all admin types are explicitly shown when editing users
Show a custom "410 gone" page for all quarantine action URL no longer available on ESG 5.x
File replication: send email notification also when SSH connection repeatedly timeouts
TLS certificates: show expiration date of active certificates

Bug fixes

Quicksand: a silently disarmed PDF no longer hides other files disarmed reports
Mail Intercept: enable/disable button is recovered
Email continuity: restore JS warning on invalid data
Advanced logging: correctly set “null” values in audit messages
Mail log: strip invalid UTF-8 character from security report and spam report
Web UI: fixed removal of Passwordless Authorized Devices
make sure graymail plugin is restarted on database reload
Quarantine settings: immediately apply per domain customization of language
Local RBL: make sure statistics are updated only on primary node
ESG 4.x migration: reset file permissions after quarantine import
Domain admin: allow domain names up to 256 character
Backup/Restore: avoid errors if quarantine files changes during a hot backup
Prevent creation of new domain admin password (see upgrade to version 5.1)
Update documentation of Whitelist and Blacklist import

Changes in v5.1.0 (Jul 11, 2022)

Security

TLS policy: changed default policy for new installation from "High Compatibility" to "Medium"
TLS policy: "Medium" policy requires TLS encryption for SMTP Authentication (as in strict policy)
TLS policy: "Strict" policy disables TLS renegotiation
Postfix: prevent DoS when multiple email to the same domain are hanging in outgoing (i.e active) queue
Improve detection of sender hosts in backscatter plugin
Web Portal Authentication: allow multiple authentication set per domain (e.g. combining G Suite with Microsoft 365 and LDAP)

Improvements

Quicksand and URLSand: allow default configuration at appliance level which also applies to new relays
Add OTP support to APIv1 login
Syslog: service is not restarted on "apply" when configuration is unchanged
Faster license usage cleanup operation through asynchronous deletion
Disk space monitor: notify by email when older data is removed because of critical disk threshold
Message details: increased readability of security reports
Message details: when a message is trusted, log if it's trusted by IP, by SMTP-auth or Authorized relay
Backup: "User Messages" configuration is now added to backup by default
Relay: automatic apply of engine configurations on every change
Cluster: the Web UI highlights all the configurations that are not replicated automatically
Web UI: "risky operations" are highlighted with a "danger" style (red color)
Mail log viewer: faster and cleaner filtering
Integration: improved memory consumption of Microsoft 365 and G-Suite import operations
User Messages: "External Warning" can now be customized
Asynchronous import from Microsoft 365, G-Suite and LDAP when started from the Web UI
Compose: show the list of available sender addresses for the logged user
Compose: hide main menu button when the user has no usable sender email
Subject tags: replaced all prefixed {tag?} with user friendlier [tag]
External warning: use the definition of "unusual correspondent" rather than "first time sender"

Bug fixes

Search page: by default search is performed as "exact match" rather than "contains" to maximize performance
Syslog: prevent double logging of some entries
G-Suite: handle Google API rate limiting to prevent issues when importing big user base
Wizard: allow manual configuration of Short and Long organization name
SNMP: only show major release in sysLocation OID
MTA: use hostname instead of domain for locally generated email to better distinguish generating servers
MTA: don't automatically add domain to envelope sender for email generated from fully-trusted IP

Breaking changes

This version introduces some changes which require your attention.

Email from M365/G-Suite sent from unmanaged domains will go through additional SMTP transport checks. For incoming email,
this will improve security since all SMTP reputation checks are always enabled. For outgoing email you have to make sure that all your domains used as "envelope sender" are listed into relay table page. Take extra care for subdomains of your relay domains, which MUST be explicitly added.
Restricted user permissions for whitelist and blacklist. The web UI will honor the user's "Quarantine Action" configuration in all pages. Some users will not be able to manage whitelists and blacklists anymore if they are not explicitly given this permission. Change the "Quarantine Action" user's configuration to include whitelists and blacklists if needed. From the user manager page you may bulk update this setting for multiple users.
Changed format of default subject tags. Subject prefixes added from ESG are now formatted as [Tag], while in previous versions were formatted as {Tags?}.
Removed old API for ISP Panel. If this appliance is controlled by an external ESG with version 5.1, after the upgrade the appliance needs to be associated again using a new API token generated from the API v2.

Version 5.0

All upgrades from previous versions are included. See the full release notes of Libraesva ESG version 5.0.