Zimbra 8.8.15 Patch-34 - share experience

Ask questions about your setup or get help installing ZCS server (ZD section below).
BradC
Outstanding Member
Outstanding Member
Posts: 265
Joined: Tue May 03, 2016 1:39 am

Re: Zimbra 8.8.15 Patch-34 - share experience

Post by BradC »

Sometimes you need to know which version of which patch you have. For example, 9.0.0 P25 was a complete cluster with 4 progressive fixes :

Code: Select all

9.0.0.1655472168.p25-2.u20 - 
9.0.0.1655455547.p25-2.u20 - 
9.0.0.1655187100.p25-2.u20 - 
9.0.0.1655029483.p25-2.u20 - 
If you are on a debian based system, you could :

Code: Select all

root@ztest:~# dpkg -l zimbra-patch
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version                    Architecture Description
+++-==============-==========================-============-=================================
ii  zimbra-patch   9.0.0.1664354709.p27-2.u20 amd64        Zimbra Network Patch
This will tell you the exact version you have installed.
jferna01
Posts: 2
Joined: Mon Oct 24, 2022 2:51 pm

Re: Zimbra 8.8.15 Patch-34 - share experience

Post by jferna01 »

Hello oetiker, thanks for your answer.
I understand what you said, but do you know if exists any table or list where I can found the relationship between the build number and the patch number?

I have checked next information:
8.8.15_GA_3953 is the patch 19
8.8.15_GA_3869 is the patch 34

Would be possible to get a list with the complete information about every patch numbers?
I have been researching on forums and official websites but I coudn't
The vulnerability what I was talking about in my previous comment is CVE-2022-41352 (affected all 8.8.15 versions, Patch 33 and below)
Thank you again.
ghen
Outstanding Member
Outstanding Member
Posts: 258
Joined: Thu May 12, 2016 1:56 pm
Location: Belgium
ZCS/ZD Version: 9.0.0

Re: Zimbra 8.8.15 Patch-34 - share experience

Post by ghen »

georgi.yankov wrote:Who in his right mind, made an update, where one of the packages has a post-install script which deletes the cpio binary from /usr/bin and its documentation?!
You're most likely compromised and the attacker removed /usr/bin/cpio, not Zimbra, see this post: viewtopic.php?f=15&t=71153&start=30#p306952
georgi.yankov
Posts: 7
Joined: Thu Oct 20, 2022 7:07 pm

Re: Zimbra 8.8.15 Patch-34 - share experience

Post by georgi.yankov »

ghen wrote:
georgi.yankov wrote:Who in his right mind, made an update, where one of the packages has a post-install script which deletes the cpio binary from /usr/bin and its documentation?!
You're most likely compromised and the attacker removed /usr/bin/cpio, not Zimbra, see this post: viewtopic.php?f=15&t=71153&start=30#p306952
God damn it, i take my words back.
You are correct, totally breached and gained persistence.
agenis
Posts: 19
Joined: Mon Oct 28, 2019 8:04 pm

Re: Zimbra 8.8.15 Patch-34 - share experience

Post by agenis »

Everything fine here, just some compatibility problems with old browsers (when there are emoticons in the subject, they are shown like four times bigger in front of the emails list)
(Centos 7, from P33)
ghen
Outstanding Member
Outstanding Member
Posts: 258
Joined: Thu May 12, 2016 1:56 pm
Location: Belgium
ZCS/ZD Version: 9.0.0

Re: Zimbra 8.8.15 Patch-34 - share experience

Post by ghen »

If you run LDAP on a separate server: install the new zimbra-ldap-patch package to fix this.
See updated patch instructions at https://wiki.zimbra.com/wiki/Zimbra_Rel ... stallation.
Post Reply