Zimbra 10.1.2 Released - Please Post Patch/Upgrade Results Here

[cayaraa]

Can we do something like this at the nginx level and restart the proxy until we can test and deploy this recent patch that may have non security related updates.

Code: Select all

    location ~* /(service|principals|dav|\.well-known|home|octopus|shf|user|certauth|spnegoauth|(zimbra/home)|(zimbra/user))/
    {
        # ZBUG-2706  Memcached poisoning with unauthenticated request
        if ($request_uri ~* "%0A|%0D") {
            return 403;
        }

        #%%% tmp until patch can be tested?
        if ($request_uri ~* "graphql"  && $request_method = GET) {
            return 403;
        }

I don't think the above code works (nginx doesn't like &&). I've been playing around with using this on my test site, and so far, it seems to be working:

Code: Select all

#%%% tmp until patch 10.0.10 can be tested
set $and 1;

if ($request_uri !~* "graphql") {
    set $and 0;
}
if ($request_method != GET) {
    set $and 0;
}
if ($and) {
    return 403;
}

In the following files:

/opt/zimbra/conf/nginx/templates/nginx.conf.web.http.default.template
/opt/zimbra/conf/nginx/templates/nginx.conf.web.https.default.template
/opt/zimbra/conf/nginx/templates/nginx.conf.web.https.template
/opt/zimbra/conf/nginx/templates/nginx.conf.web.http.template

-Aaron

[wentum]

Hello Aaron,

this sounds really cool!

I checked those mentioned files but I ask myself where to put it there?
Where did you put it to make it work?

Regards
Joerg

[JDunphy]

I don't think the above code works (nginx doesn't like &&). I've been playing around with using this on my test site, and so far, it seems to be working:

-Aaron

Nice! ....Thanks for sharing your solution. The only other way I can think of given nginx's limited if directive or your working solution might be the following:

Code: Select all

location ~* /(service|principals|dav|\.well-known|home|octopus|shf|user|certauth|spnegoauth|(zimbra/home)|(zimbra/user))/ {

    # ZBUG-2706  Memcached poisoning with unauthenticated request 
    if ($request_uri ~* "%0A|%0D") {
        return 403;
    }

    # %%% tmp solution until running patched code that disables this.
    if ($request_method = GET) {
        rewrite ^(.*graphql.*) /forbidden last;
        # more rewrite rules below to block future exploits ;-)
    }
    ...
    ...
}

# %%% added to force query's we want to terminate
location = /forbidden {
    return 403;
}

I have not tested this (nginx -t).

[cayaraa]

Hello Aaron,

this sounds really cool!

I checked those mentioned files but I ask myself where to put it there?
Where did you put it to make it work?

Regards
Joerg

I was putting them under "# ZBUG-2706" just like JDunphy.

-Aaron

[zmcontrol]

Do you restart mailbox servers every night?

jzzr,

I checked and the 'send later' bug continued with or without mailboxd restarting.
However testing has been successful so far with the following commits:

https://github.com/Zimbra/zm-mailbox/co ... /ZBUG-4384

[jzzr]

Hello,

Yes, we've just finished testing. And in addition to the bug when rebooting mailboxd, in addition to bug ZBUG-4384, there is a bug with ActiveSync under Android and “send later”.

An account that doesn't use Activesync is fine. But if the account synchronizes with ActiveSync, the message is not sent, it remains in the drafts.

Bug not reported to us before version 10.1.2

[lytledd]

Tried upgrading from Release 10.1.0.GA.4200000.UBUNTU22.64 UBUNTU22_64 FOSS edition to

zcs-10.1.2_GA_4200000.UBUNTU22_64.20240924075512.tgz

Running on Ubuntu 22.04.5 LTS with 4 Cores & 16GB memory. It failed in the middle of processing.

Both the install logs and the zmsetup logs show there were no errors, but the console output showed

Code: Select all

ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/opt/zimbra/data/tmp/mysql/mysql.sock' (111 "Connection refused")
Sat Nov  9 10:31:45 2024: Error while running '/opt/zimbra/bin/mysql --user=zimbra --password=REDACTED --database=zimbra --batch --skip-column-names'.

Reverted the snapshop and then cloned the VM for futher testing.

Should this be a new thread?

Zimbra install logs
https://pastebin.com/hzAiWxTU

zmsetup logs

https://pastebin.com/rdSRNiZD

Thanks!

Doug

[jzzr]

Hello,

We sent a case to support for 3 bugs with “send later”: bug when rebooting mailboxd, bug with ActiveSync, bug in mailbox.log (already reported with version 8.8.15).

Result: only the first one resulted in a BUG: ZBUG-4422.

...

[adrian.gibanel.btactic]

Tried upgrading from Release 10.1.0.GA.4200000.UBUNTU22.64 UBUNTU22_64 FOSS edition to
zcs-10.1.2_GA_4200000.UBUNTU22_64.20240924075512.tgz

Should this be a new thread?

Unless stated otherwise this forum threads are about Synacor Zimbra NE binary releases.

According to your Zimbra version you seem to have an issue with a Maldua FOSS build. Either use their issues page or their specific thread here in the forum.

[jzzr]

Hi

ZBUG-4541 : Bug with "send later" Activesync Android

if you synchronize the account with ActiveSync on Android => messages are not sent, it remains in the drafts

Prior to version 10.1.1, we had no feedback from users on this type of bug.