ClamAV 1.5.0 beta now available!

Read this online at: https://blog.clamav.net/2025/03/clamav-150-beta-now-av=
ailable.html


The ClamAV 1.5.0 beta is now available. You may find the source code and in=
stallers for this release at clamav.net/downloads<https://www.clamav.net/do=
wnloads> or on the ClamAV GitHub release page<https://github.com/Cisco-Talo=
s/clamav/releases/tag/clamav-1.5.0-beta>.
The beta phase is expected to last two to four weeks before we publish the =
stable release or else publish a release candidate. This will depend on how=
 many changes are required to stabilize this version. Please take this time=
 to evaluate ClamAV 1.5.0.
Please help us validate this release by providing feedback via GitHub issue=
s<https://github.com/Cisco-Talos/clamav/issues>, via the ClamAV mailing lis=
t<https://lists.clamav.net/mailman/listinfo/clamav-users> or on our Discord=
<https://discord.gg/sGaxA5Q>.
IMPORTANT: A major feature of the 1.5 release is a FIPS-compliant method fo=
r verifying the authenticity of CVD signature database archives and CDIFF s=
ignature database patch files. The feature is ready to test in this beta, b=
ut we are not yet distributing the associated =93.cvd.sign=94 signature fil=
es for the daily, main, and bytecode databases. Because these files aren=92=
t available, ClamAV will fall back to using the legacy MD5-based RSA signat=
ure check. In other words, Freshclam will continue to fail on FIPS-enabled =
systems, for now. However, the unit tests do include a test signing key and=
 certificate pair along with tests to exercise signing and verification usi=
ng the FIPS-compliant method.
Note: Windows builds on GitHub Actions, which use VCPkg to provide C librar=
y dependencies, are failing at this time.
Tip: If you are downloading the source from the GitHub release page, the pa=
ckage labeled "clamav-1.5.0-beta.tar.gz" does not require an internet conne=
ction to build. All dependencies are included in this package. However, if =
you download the ZIP or TAR.GZ generated by GitHub, located at the very bot=
tom, then an internet connection will be required during the build to downl=
oad additional Rust dependencies.
For Docker users, there is no specific Docker tag for the beta, but you can=
 use the clamav:unstable or clamav:unstable_base tags.
ClamAV 1.5.0 includes the following improvements and changes:
Major changes

  *   Added checks to determine if an OLE2-based Microsoft Office document =
is encrypted.
     *   GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/129=
5>
  *   Added the ability to record URLs found in HTML if the generate-JSON-m=
etadata feature is enabled. Also adds an option to disable this in case you=
 want the JSON metadata feature but don't want to record HTML URL's. The Cl=
amScan command-line option is =93--json-store-html-urls=3Dno=94. The clamd.=
conf config option is =93JsonStoreHTMLUrls no=94.
     *   GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/128=
1>
  *   Added regex support for the clamd.conf OnAccessExcludePath config opt=
ion. This change courtesy of GitHub user b1tg.
     *   GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/131=
4>
  *   Added FIPS-compliant CVD signing/verification with external .sign fil=
es.
Freshclam will now attempt to download external signature files to accompan=
y existing .cvd databases and .cdiff patch files. Sigtool now has commands =
to sign and verify using the external signatures.

ClamAV now installs a 'certs' directory in the app config directory (e.g. <=
prefix>/etc/certs). The install path is configurable. The CMake option to c=
onfigure the CVD certs directory is =93-D CVD_CERTS_DIRECTORY=3DPATH=94.

Added sign/verify commands to Sigtool.

New options to set an alternative CVD certs directory:
- The command-line option for Freshclam, ClamD, ClamScan, and Sigtool is: -=
-cvdcertsdir PATH
- The environment variable for Freshclam, ClamD, ClamScan, and Sigtool is: =
CVD_CERTS_DIR

The config option for Freshclam and ClamD is: CVDCertsDirectory PATH

Added two new APIs to the public clamav.h header:
extern cl_error_t cl_cvdverify_ex(const char *file,
                                  const char *certs_directory);
extern cl_error_t cl_cvdunpack_ex(const char *file,
                                  const char *dir,
                                  bool dont_verify,
                                  const char *certs_directory);

The original cl_cvdverify and cl_cvdunpack are deprecated.

Added a cl_engine_field enum option CL_ENGINE_CVDCERTSDIR. You may set this=
 option with cl_engine_set_str and get it with cl_engine_get_str to overrid=
e the compiled in default CVD certs directory.

Thank you to Mark Carey at SAP for inspiring work on this feature with an i=
nitial proof of concept for external-signature FIPS compliant CVD signing.
     *   GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/141=
7>

Other improvements

  *   Set a limit on the max-recursion config option. Users will no longer =
be able to set max-recursion higher than 100. This change prevents errors o=
n start up or possible crashes if encountering a file with that many layers=
 of recursion.
     *   GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/126=
4>
  *   Build system: CMake improvements to support compiling for the AIX pla=
tform. This change is courtesy of GitHub user KamathForAIX.
     *   GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/138=
7>
  *   Improve support for extracting malformed .zip archives. This change i=
s courtesy of Frederick Sell.
     *   GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/146=
0>
  *   Windows: Code quality improvement for the ClamScan and ClamDScan --mo=
ve and --remove options. This change is the courtesy of Maxim Suhanov.
     *   GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/147=
0>
  *   Added file type recognition for some kinds of AI model files.

The file type appears as a string parameter for these callback functions:
  - clcb_pre_cache
  - clcb_pre_scan
  - clcb_file_inspection

When scanning these files, the `type` parameter will now show "CL_TYPE_AI_M=
ODEL" instead of "CL_TYPE_BINARY_DATA".
     *   GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/147=
6>

Bug fixes

  *   Technical debt: Reduced email multipart message parser complexity.
     *   GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/134=
7>
  *   Fixed possible undefined behavior in inflate64 module. The inflate64 =
module is a modified version of the zlib library, taken from version 1.2.3 =
with some customization and with some cherry-picked fixes. This adds one ad=
ditional fix from zlib 1.2.9. Thank you to TITAN Team for reporting this is=
sue.
     *   GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/146=
9>
  *   Fixed a bug in ClamD that broke reporting of memory usage on Linux. T=
he STATS command can be used to monitor ClamD directly or through ClamDTOP.=
 The memory stats feature does not work on all platforms (e.g. Windows).
     *   GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/146=
5>
  *   Windows: Fix a build issue when the same library dependency is found =
in two different locations.
     *   GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/145=
3>
  *   Fix an infinite loop when scanning some email files in debug-mode. Th=
is fix is courtesy of Yoann Lecuyer
     *   GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/144=
5>

Acknowledgments
Special thanks to the following people for code contributions and bug repor=
ts:

  *   b1tg
  *   Frederick Sell
  *   KamathForAIX
  *   Mark Carey at SAP
  *   Maxim Suhanov
  *   TITAN Team
  *   Yoann Lecuyer



Val Snyder (they/them)
ClamAV Development
Talos
Cisco Systems, Inc.
_______________________________________________

clamav-devel mailing list
[email protected]
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/cl=
amav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml