Zimbra Forums

I find it quite puzzling btw, that the 10.1.19 release wiki page is referring to "the SNMP mitigation", which was communicated only to customers and marked "highly confidential"?

Why didn't they just ship that fix with 10.1.19?

Zimbra 10.1.19 is essentially a two-line patch in 2 javascript files (and corresponding .zgz files) in zimbra-mbox-webclient-war. The zimbra-patch package itself does nothing extra. Safe to install.

Make sure to update the packages first which will break nginx... and then run ./install.sh to upgrade so that the right permissions are put in place and nginx works again as expected. Just running /opt/zimbra/libexec/zmfixperms is sufficient and much quicker (it's what zimbra-proxy-patch does after...

Just like Red Hat does for RHEL 7 until May 2029. (But not CentOS obviously.)

The Zimbra 10.1.18 patch is available for Ubuntu 18.04 as well, so Zimbra still considers it supported.

10.1.11 was the last Zimbra patch release for EL 7.

We just clone https://github.com/Zimbra/packages/ (and https://github.com/Zimbra/zimbra-package-stub) on a build server and build individual packages under the thirdparty/<package> directories. You can modify versions.def for the versions and make changes to the rpm specfile or debian control files ...

Fully agreed. We too have been running our own nginx builds with backported patches, upgraded OpenLDAP (2.4.x, 2.5.x, now 2.6.x), upgraded OpenSSL, etc, for years. Pull requests to the packages repo and other contributions get completely ignored, unless you repeatedly push for it via Support and Pro...

this might be shadowed in NE by the zimbra-proxy-patch packages that might enforce those user/group ownership and fix that. You're right, the zimbra-proxy-patch package runs zmfixperms in its postinstall (see rpm -q zimbra-proxy-patch --scripts) ... after the zimbra-nginx package installs it with s...

Here's the original disclosure: https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb We’re publishing HTTP/2 Bomb, a remote denial-of-service exploit against most major web servers, including: nginx Apache httpd Microsoft IIS Envoy Cloudflare Pingora The vulnerable behavior exists in each se...