Important - Please patch all 8.8.15 mailbox servers

[Klug]

I see nothing here but I just got a mail from Zimbra so here it is.

Security Update for Zimbra Collaboration Suite Version 8.8.15

A security vulnerability in Zimbra Collaboration Suite Version 8.8.15 that could potentially impact the confidentiality and integrity of your data has surfaced. We take this matter very seriously and have already taken immediate action to address the issue.

Issue Fixed
The issue has been fixed. We have also performed rigorous testing to ensure the effectiveness and stability of the system. The fix is planned to be delivered in the July patch release.

Take Action. Apply Fix Manually
We understand that you may want to take action sooner rather than later to protect your data.

To maintain the highest level of security, we kindly request your cooperation to apply the fix manually on all of your mailbox nodes.

Steps to apply the fix manually on all of your mailbox nodes
Take a backup of the file /opt/zimbra/jetty/webapps/zimbra/m/momoveto

Edit this file and go to line number 40
Update the parameter value as below

Code: Select all

<input name="st" type="hidden" value="${fn:escapeXml(param.st)}"/>

Before the update, the line appeared as below

Code: Select all

<input name="st" type="hidden" value="${param.st}"/>

After the update, the line should appear as below

Code: Select all

<input name="st" type="hidden" value="${fn:escapeXml(param.st)}"/>

Note: Zimbra service restart is not required so you can do it without any downtime.

We apologize for any inconvenience this may cause, and we thank you for your understanding.

Zimbra is committed to providing you with the highest level of security, and we will continue to work diligently to protect your data.

[agenis]

Many thanks!!! Haven't received anything here, are you a paying customer?

[L. Mark Stone]

Many thanks!!! Haven't received anything here, are you a paying customer?

You don't need to be a paying customer (and shouldn't need to be a paying customer IMHO) to get these notifications; you just need to sign up for Zimbra's Security Mailing List.

Go to https://www.zimbra.com/downloads/ and look for the box entitled "Stay up to date with Zimbra Product and Security Updates"

Put in your email address (or better, a Distribution List email for the whole IT team...), click "Subscribe" and you'll get these notifications going forward.

Hope that helps,
Mark

[JDunphy]

Thanks. I didn't see this either and we are a paying customer. Here is my patch script I plan on using. Will only apply once.

Code: Select all

#!/bin/sh
#
#  Security patch 8.8.15 (July 12, 2023)
#
momoveto=/opt/zimbra/jetty/webapps/zimbra/m/momoveto
#momoveto=/tmp/momoveto

grep -q 'fn:escapeXml(param.st)' $momoveto
if [ $? -eq 1 ]; then
   cp $momoveto $momoveto.bak

   echo "Appying patch to $momoveto"
#     <input name="st" type="hidden" value="${param.st}"/>
   sed -i -e 's,    <input name="st" type="hidden" value="${param.st}"/>,    <input name="st" type="hidden" value="${fn:escapeXml(param.st)}"/>,g' $momoveto
else
   echo "nothing to patch"
fi

Note: am signed up on the security mailing list. Have seen these before. Perhaps still incoming to us.

Jim

[Klug]

I got it twice, on two email addresses I used to register for a demo license (lots of years ago).
I don't know if I'm registered to the security mailing list.

But last time such email arrived, it seems it was sent by batch (based on domain name).
Some customers of ours got it several hours before/after me.

[ghen]

FWIW, we applied the fix with ansible:

Code: Select all

   - name: fix XSS in /m/momoveto (ZBUG-3490)
     replace:
       path: /opt/zimbra/jetty/webapps/zimbra/m/momoveto
       regexp: '\${param.st}'
       replace: '${fn:escapeXml(param.st)}'

Taken from here: https://github.com/Zimbra/zm-web-client/pull/827

[ghen]

Btw, we also haven't received any mail notification (yet). Just grabbed the patch from github a few days ago.

[oetiker]

The office web link of the information

https://info.zimbra.com/security-update ... -important

[ghen]

Btw, there have been *many* similar XSS fixes in recent Zimbra patch releases. So I wonder whether this one is “worse” than others to warrant an explicit warning & pre-patch fix? Or is this just a new initiative from Zimbra to better inform customers of new vulnerabilities?

[jeastman]

Btw, there have been *many* similar XSS fixes in recent Zimbra patch releases. So I wonder whether this one is “worse” than others to warrant an explicit warning & pre-patch fix? Or is this just a new initiative from Zimbra to better inform customers of new vulnerabilities?

I don't know that I would classify this as any worse than previous XSS issues.

I have asked the team to not sit on security fixes for the next patch cycle. Since the scheduled patch releases are cumulative, releasing specific security fixes out-of-schedule should not pose a problem for those who want to wait for the normal cycle. There will always be a balance here. With Zimbra being Open Source, most vulnerability fixes are essentially public at the time they are fixed regardless of documented disclosure. Releasing security fixes as patches as soon as they are available is an attempt to avoid any vulnerability gaps.

As always, feedback is welcome on this process. It sounds like the notification may not have gone out on all of the appropriate channels (security/update email list). I am checking to see if there were any issues. Due to privacy compliance, you will need to explicitly opt-in to those announcements as noted by Mark.