New Appliance Release 15.1.1

A new SEPPmail Appliance release has been published. Please see the revision history and the extended release notes for further details.

For a quick overview here are the changes coming with this release

Admin

• Fixed an issue where the managed domain settings page was not loaded correctly after creating a new managed domain.
• Fixed the disclaimer HTML preview.
• Fixed an issue where disclaimer and template configuration files were not written in UTF-8 encoding, which could corrupt special characters.
• Allow import of multi customer backups as new a customer.

Background tasks

• All cluster members now create a database backup, while only the maintenance node sends it, so a usable backup is available even if the database of the maintenance node is damaged.
• A missing backup operator is no longer reported as an error in the daily report, as large databases are usually backed up via SCP instead.
• Limited the default core dump size to prevent large core dumps from filling up the /tmp partition.
• Cleanup temporary files while maillog index creation to prevent a full tmp-partition.\
  If you notice any anomalies in the log view—such as missing time ranges—it’s best to rebuild the mail log index under “Logs >> Show other logs… >> Deleted mail log archive index.”

Disclaimer

• The Content-ID headers of disclaimer inline images and attachments are now RFC 2045 compliant.

Libraries

• Update OpenSSL to version 3.5.9
• Update OpenSSH sshd to version 10.6

Logging

• Added error handling so the database logging page loads correctly even if a log entry contains empty data.
• Fixed an issue where rotated mail log files could not be viewed and rebuilding the mail log archive index caused errors.

MPKI

• Adapted the D-Trust MPKI connector to the new connector specification 2.28.
• Fixed an issue where the SwissSignREST MPKI connector settings were not loaded in the Admin GUI.
• Updated the GlobalSign root CA certificate chain so that GlobalSign certificates can be issued correctly.
• Certificate orders via the SwissSignREST connector that are not issued in time are now kept as pending requests and completed later, preventing duplicate certificates.

Operating system

• Fixed a regression where external DNS names could no longer be resolved after a local DNS zone was configured with the built-in DNS resolver.
• Fixed an issue in the OpenBSD kernel that prevented hard disks from being detected on Azure systems.

RestAPI

• Fixed the error handling of PUT /v1/ssl, which returned an internal server error instead of the actual error message.
• Fixed PUT /webmail/domain/{domainName} failing with an internal server error when “Initial password via SMS” is enabled.

Rule engine

• If signing or encryption is requested and no key material exists, a key or certificate is now generated automatically (and a local user created if necessary) instead of bouncing the message, provided automatic key generation and user creation are enabled.
• Fixed an issue in the make_lft() RuleSet function that occurred when an LFT had multiple recipients and only some of them were permitted to make the LFT.

S/MIME

• If “Delete expired certificates automatically” and “Automatically check revocation status every day” are enabled, revoked certificates are now deleted automatically as well.
• Fixed an issue where the result of a CRL check did not override the OCSP check result, so revoked certificates were not marked as revoked.

Security

• Affected versions: <15.1.1 - CVE-ID: CVE-2026-114424 - CVSS Score: 9.2\
  Description: Improper handling of replacement values in address replacement rules could allow a remote sender to execute arbitrary commands on the appliance if a ruleset uses values taken from the message as replacement.\
  Fix Description: The evaluation of replacement values in address replacement rules was hardened to prevent code execution.
• Affected versions: <15.1.1 - CVE-ID: CVE-2026-114425 - CVSS Score: 9.2\
  Description: Specially crafted attachment metadata in an incoming message could cause the Large File Transfer processing to read or delete arbitrary files on the appliance.\
  Fix Description: Attachment metadata received with a message is now validated before any file is accessed.
• Affected versions: <15.1.1 - CVE-ID: CVE-2026-114421 - CVSS Score: 6.9\
  Description: Insufficient input escaping in account lookups combined with missing validation in the password recovery process could allow an unauthenticated attacker to discover GINA accounts without a password and take them over.\
  Fix Description: LDAP filter values are now escaped, and the password recovery only asks registered users with configured security questions.
• Affected versions: <15.1.1 - CVE-ID: CVE-2026-114420 - CVSS Score: 8.3\
  Description: Insufficient input escaping in account lookups combined with missing validation in the password recovery process could allow an unauthenticated attacker to discover GINA accounts without a password and take them over.\
  Fix Description: LDAP filter values are now escaped, and the password recovery only asks registered users with configured security questions.
• Affected versions: <15.1.1 - CVE-ID: CVE-2026-114426 - CVSS Score: 8.7\
  Description: The file upload interface processed request data before checking authentication, which could allow an unauthenticated attacker to exhaust disk space and worker processes.\
  Fix Description: Authentication is now checked before upload data is processed, and the upload size is limited.
• Removed the acceptance of PGP keys with user IDs that are not self-signed.
• PGP messages that are not actually encrypted (NULL encryption) are now detected and no longer marked as encrypted.

Virtualization

• Added support for the QEMU guest agent (qemu-ga).

Webmail

• Fixed an issue where GINA read receipts were only sent for the first recipient of a message sent to multiple recipients.
• With this release, the GINAv2 beta phase ends, and the GINAv2 options have been removed from the GINA domain settings. The final version of GINAv2 is nearly complete and will be released soon.