Zimbra 10.1.13 Released - Please Post Your Patch/Upgrade Results Here

[adamdudzik]

In the patch description I did not see any information regarding changes to the IMAP protocol. However, after updating to version 10.1.13, our email backup solution (MailStore) stopped working.

In the MailStore log I can see:

08:23:14.914 [23] INFO: Retrieving message with Cache-Message-ID 20PUAKV7O (UID: 2711246, UIDVALIDITY: 3592437)
08:23:14.914 [23] INFO: IMAP command sent: R0003E UID FETCH 2711246 (UID BODY.PEEK[])
08:23:14.914 [23] EXCEPTION: ImapVirtualConnection.WithConnectionInternal
Rebex.Net.ImapException: Invalid IMAP response.


followed by a cascade of subsequent errors:

08:23:14.914 [23] INFO: Retrieving message with Cache-Message-ID 20PUAKV7U (UID: 2711252, UIDVALIDITY: 3592437)
08:23:14.914 [23] EXCEPTION: ImapVirtualConnection.WithConnectionInternal
System.InvalidOperationException: Cannot send command to the server because the response for the previous one was not received.


Could you please address this issue? As mentioned, everything was working correctly before the update to 10.1.13, so the malfunction appears to be caused by the changes introduced in this patch.

[jered]

In the patch description I did not see any information regarding changes to the IMAP protocol. However, after updating to version 10.1.13, our email backup solution (MailStore) stopped working.

This is almost certainly due to the OpenSSL upgrade and:

• Strengthened TLS handling per updated RFC standards

I don't have specific guidance on what to change, but that is where I would look -- your backup client is probably not supporting modern cipher recommendations.

[Jumble8014]

In the patch description I did not see any information regarding changes to the IMAP protocol. However, after updating to version 10.1.13, our email backup solution (MailStore) stopped working.

This is almost certainly due to the OpenSSL upgrade and:

• Strengthened TLS handling per updated RFC standards

I don't have specific guidance on what to change, but that is where I would look -- your backup client is probably not supporting modern cipher recommendations.

I don't think it is related to SSL. I also have IMAP issues (intermittent imap protocol errors) with my desktop email client and the gmail app on Android has empty mail bodies for emails synced since the update. If this was an OpenSSL issue, I wouldn't expect to see the email entries at all.

[ghen]

OpenSSL 3.5 introduces post-quantum key exchange (X25519MLKEM768), but removed no legacy crypto compared to 3.0.x.

The easiest (and future-proof) way to enable PQC with Zimbra 10.1.13+ is to set zimbraReverseProxySSLECDHCurve to "auto".

[stefano.marchetto]

Hi,
after updating to 10.1.13 yesterday we noticed a couple of problems for our users:
- Android clients no longer show up e-mail in readable form when connecting through IMAP
- Applying filters with Thunderbird duplicates filtered messages several times

[Klug]

- Applying filters with Thunderbird duplicates filtered messages several times

I guess you're using IMAP with Thunderbird?

[jered]

OpenSSL 3.5 introduces post-quantum key exchange (X25519MLKEM768), but removed no legacy crypto compared to 3.0.x.

The easiest (and future-proof) way to enable PQC with Zimbra 10.1.13+ is to set zimbraReverseProxySSLECDHCurve to "auto".

Yup -- having had coffee and re-read the log excerpt, I'm definitely wrong on pointing at OpenSSL. This seems to be a specifically IMAP issue.

@adamdudzik can you turn up logging on MailStore enough to get the Invalid IMAP Response full text?

[Jumble8014]

imap debug logs from my client show two identical server responses for two subsequent commands, maybe some caching issue is involved but it's (for now) unpredictable when it happens.

Code: Select all

[imapx:A] Starting command ( literal) A00023 STATUS "Activity Stream" (MESSAGES UNSEEN UIDVALIDITY UIDNEXT HIGHESTMODSEQ)
[imapx:A] I/O: 'A00023 STATUS "Activity Stream" (MESSAGES UNSEEN UIDVALIDITY UIDNEXT HIGHESTMODSEQ)'
[imapx:A] I/O: '* STATUS "Activity Stream" (MESSAGES 37934 UIDNEXT 811839 UIDVALIDITY 604458 UNSEEN 1 HIGHESTMODSEQ 1690659)
A00023 OK STATUS completed'
[imapx:A] got untagged response
[imapx:A] Have token 'STATUS' id 0
[imapx:*] CamelIMAPXStore::mailbox-updated ("Activity Stream")
[imapx:A] Got completion response for command 00023 'STATUS'
[imapx:A] camel_imapx_server_process_command_sync: 0x7fcce4054e10 ~> (nil); success:1 local-error:[null] result:OK status-text:'
STATUS completed'
[imapx:A] adding command, format = 'SELECT %M'
[imapx:A] adding command, format = ' (QRESYNC (%lu %lu %s'
[imapx:A] got glong '604458'
[imapx:A] got glong '1616717'
[imapx:A] got string '281710:811832'
[imapx:A] adding command, format = ' (%s %s)'
[imapx:A] got string '1,18251,31373,35747,37205,37691,37853,37907,37925'
[imapx:A] got string '281710,431909,606178,795896,808278,809859,811486,811619,811716'
[imapx:A] adding command, format = '))'
[imapx:A] completing command buffer is [180] 'SELECT "Activity Stream" (QRESYNC (604458 1616717 281710:811832 (1,18251,31373,357
47,37205,37691,37853,37907,37925 281710,431909,606178,795896,808278,809859,811486,811619,811716)))'
[imapx:A] camel_imapx_server_process_command_sync: (nil) () ~> 0x7fcce4054e10 (SELECT)
[imapx:A] Starting command ( literal) A00024 SELECT "Activity Stream" (QRESYNC (604458 1616717 281710:811832 (1,18251,31373,3574
7,37205,37691,37853,37907,37925 281710,431909,606178,795896,808278,809859,811486,811619,811716)))
[imapx:A] I/O: 'A00024 SELECT "Activity Stream" (QRESYNC (604458 1616717 281710:811832 (1,18251,31373,35747,37205,37691,37853,37
907,37925 281710,431909,606178,795896,808278,809859,811486,811619,811716)))'
[imapx:A] I/O: '* STATUS "Activity Stream" (MESSAGES 37934 UIDNEXT 811839 UIDVALIDITY 604458 UNSEEN 1 HIGHESTMODSEQ 1690659)
A00023 OK STATUS completed'
[imapx:A] got untagged response
[imapx:A] Have token 'STATUS' id 0
[imapx:*] CamelIMAPXStore::mailbox-updated ("Activity Stream")
[imapx:A] camel_imapx_server_process_command_sync: 0x7fcce4054e10 ~> (nil); success:0 local-error:got response tag unexpectedly:
 A00023 result:[null] status-text:'[null]'
[imapx:A] Removed connection 0x7fcce406d970 (server:0x7fcce40015d0) due to error: Failed to select mailbox: got response tag une
xpectedly: A00023
[imapx:A] I/O: ''

[jzzr]

Hi

Since patch 10.1.13, we have also been experiencing problems with IMAP.

With Outlook configured for IMAP, “folder synchronization with subscription” never completes and new emails are not visible.
We get this message every time the account accesses shared folders that are in mailboxes stored on servers other than the main mailbox.

With Mail on macOS, it takes a very long time to display emails in these folders when opening them for the first time.

Are you also experiencing these issues?

[michael.hart]

We also have several users experiencing IMAP issues with Outlook since upgrading to 10.1.13. Users are seeing empty emails (no headers and no body) and corrupted emails.
We're seeing these errors in the mailbox.log:
;ua=Microsoft Outlook/16.0.19127.20314;cid=2929;] imap - IMAP ID with name/version provided duplicate values, command ignored
;ua=Microsoft Outlook/16.0.19231.20216;cid=2851;] imap - NIO:zimbraImapMaxConsecutiveError exceeded 10
;ua=Microsoft Outlook/16.0.19127.20314;cid=29818;] imap - RENAME failed
;ua=Microsoft Outlook/16.0.19328.20178;cid=1329;] imap - IOException fetching IMAP message