ClamAV 1.5.0 Released: Major Update Adds FIPS Mode Support and Switches Cache Hashing to SHA-256
The ClamAV 1.5.0 antivirus engine has been released, introducing one of the most significant updates in recent years — FIPS mode support for verifying the authenticity of signature databases. The Freshclam and CVDUpdate tools can now utilize “.cvd.sign” signature files for database archives and CDIFF updates. In the absence of these files, the system will revert to the legacy RSA verification method based on MD5. This enhancement enables the official deployment of ClamAV within FIPS-certified infrastructures, where the use of outdated and insecure hashing algorithms is strictly prohibited.
Developers have added dedicated parameters for specifying the CVD certificate directory, now supporting environment variables, command-line arguments, and configuration file options. New API functions have been introduced for verifying and unpacking databases, replacing the deprecated cl_cvdverify and cl_cvdunpack methods. Furthermore, the engine can now automatically detect whether FIPS mode is enabled in the system and enforce restrictions on the use of MD5 and SHA1 during digital signature verification.
The update also improves the safe file caching system, which now employs SHA-256 instead of MD5. This shift eliminates the risk of hash collisions and ensures compatibility with environments that impose strict cryptographic compliance requirements.
The ClamD service now allows administrators to disable specific commands — from shutdown requests to statistics output — enhancing security when the daemon is deployed in multi-tiered environments. Additionally, regular expression support has been added to the OnAccessExcludePath parameter, enabling more flexible configuration of directory exclusions.
Key improvements include external database signature support, enhanced hashing functions with FIPS bypass flags, extended JSON metadata formats, and the option to log URIs extracted from HTML and PDF documents — with the ability to disable this feature when desired. The ClamScan command can now display both the file type and hash for each scanned object, with scan results presented using precise units of measurement — from bytes to gigabytes.
The libclamav library introduces new scanning functions with extended parameters, allowing the transmission of file hashes, types, and contextual metadata. The mechanism for handling temporary directories during recursive scanning has been refined, and new callback functions have been added, enabling developers to intercept specific analysis stages — from initial hashing and classification to final infection alerts. Each attachment now receives a unique object identifier and can be processed independently, including embedded files that were previously excluded from standalone scans.
JSON metadata has become far more sophisticated: instead of a flat list of detected threats, it now includes categorized indicators — strong, potentially unwanted, and weak. This structure lays the groundwork for the development of multi-trigger composite signatures in future versions. Support has also been added for storing multiple hash values (MD5, SHA1) alongside the primary SHA-256, as well as a new file type, CL_TYPE_AI_MODEL, for identifying artificial intelligence model files.
Other changes include a recursion depth limit of 100 levels, improved platform support for AIX, Solaris, and GNU/Hurd, greater resilience when handling corrupted ZIP archives, and added comments within configuration files. The obsolete MyDoom heuristic has been removed, numerous Windows build issues have been fixed, and several potential security flaws — including stack overflows and race conditions in Freshclam — have been addressed.
The developers expressed special gratitude to community contributors, including engineers from SAP, the TITAN Team, and independent researchers who assisted in strengthening ClamAV’s cryptographic components and eliminating vulnerabilities. ClamAV 1.5.0 is now available for download from the project’s official website and its GitHub release page.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
