Zimbra Releases/10.0.8

Zimbra Collaboration Daffodil 10.0.8 Patch Release

Release Date: April 22, 2024

IMPORTANT: Admin Account authentication now honors zimbraAuthFallbackToLocal when using external/custom authentication. See: https://blog.zimbra.com/2024/04/admin-account-authentication-now-honors-zimbraauthfallbacktolocal/

Check out the Security Fixes, What's New, Fixed Issues, Things to Know Before Upgrading and Known Issues sections for this version of Zimbra Collaboration. Please refer to the Patch Installation steps for Patch Installation instructions. As always, you are encouraged to tell us what you think in the Forums or open a support ticket to report issues.


IMPORTANT: Instructions to update Zimbra's onlyoffice repository for installing zimbra-onlyoffice package.

Please note that there is no change in the onlyoffice package. Add Zimbra's onlyoffice repository to the server before Zimbra Daffodil v10 installation/upgrade. These repos will be included bydefault in upcoming Zimbra Daffodil version. 

https://repo.zimbra.com/apt/onlyoffice

https://repo.zimbra.com/rpm/onlyoffice

You must add your local repository to your RHEL/CentOS Configuration :

Redhat

RHEL7 

$ cat > /etc/yum.repos.d/zimbra-onlyoffice.repo <<EOF
[zimbra-onlyoffice]
name=Zimbra Onlyoffice RPM Repository
baseurl=https://repo.zimbra.com/rpm/onlyoffice/rhel7
gpgcheck=1
enabled=1
EOF

RHEL8 

$ cat > /etc/yum.repos.d/zimbra-onlyoffice.repo <<EOF
[zimbra-onlyoffice]
name=Zimbra Onlyoffice RPM Repository
baseurl=https://repo.zimbra.com/rpm/onlyoffice/rhel8
gpgcheck=1
enabled=1
EOF

rpm --import https://files.zimbra.com/downloads/security/public.key
yum --disablerepo=* --enablerepo=zimbra-onlyoffice clean metadata
yum check-update --disablerepo=* --enablerepo=zimbra-onlyoffice --noplugins


Ubuntu

UBUNTU18 

$ cat > /etc/apt/sources.list.d/zimbra-onlyoffice.list << EOF
deb [arch=amd64] https://repo.zimbra.com/apt/onlyoffice bionic zimbra
deb-src [arch=amd64] https://repo.zimbra.com/apt/onlyoffice bionic zimbra
EOF

UBUNTU20 

$ cat > /etc/apt/sources.list.d/zimbra-onlyoffice.list << EOF
deb [arch=amd64] https://repo.zimbra.com/apt/onlyoffice focal zimbra
deb-src [arch=amd64] https://repo.zimbra.com/apt/onlyoffice focal zimbra
EFO

apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 9BE6ED79
apt-get update


IMPORTANT: Zimbra OpenSSL with default FIPS Configuration

  • Please be advised that, TLS 1.2 is the minimum supported version if FIPS is being used with OpenSSL 3.0. We recommend using Zimbra with strong TLS configuration for increased security. Please follow instructions in Cipher-suites-wiki to set correct ciphers as per current versions of openssl, nginx and postfix.


  • From this patch going forward Zimbra OpenSSL will be configured to work with FIPS compliance enabled by default. You do not need to take any action, unless you run into issues, you can switch to the non-FIPS provider as follows:
  • Run below commands to Enable/Disable FIPS providers on all servers.

Disable FIPS provider: 

As root user run below commands

Take backup of openssl.cnf
cd /opt/zimbra/common/etc/ssl
cp openssl.cnf <backup-path>/openssl.cnf

Copy openssl-source.cnf file
cd /opt/zimbra/common/etc/ssl
cp openssl-source.cnf openssl.cnf

Verify that, FIPS provider is disabled:
Run below command and verify fips provider is not listed
/opt/zimbra/common/bin/openssl list --providers

As zimbra user run below commands
su - zimbra
zmcontrol restart

Enable FIPS provider: 

As root user run below commands

Take backup of openssl.cnf
cd /opt/zimbra/common/etc/ssl
cp openssl.cnf <backup-path>/openssl.cnf

Copy openssl-fips.cnf file
cd /opt/zimbra/common/etc/ssl
cp openssl-fips.cnf openssl.cnf

Verify that, FIPS provider is enabled:
Run below command and verify fips provider is listed
/opt/zimbra/common/bin/openssl list --providers

As zimbra user run below commands
su - zimbra
zmcontrol restart


Security Fixes

Summary CVE-ID CVSS Score
SMTP Smuggling vulnerability Patched [ZBUG-3780] CVE-2023-51764 5.3
Upgraded PHP to 8.3.0 to fix allocated memory vulnerability [ZBUG-3082] CVE-2021-21708 9.8
An XSS vulnerability was observed due to the execution of malicious JavaScript code from an externally shared file via non-sanitized parameter [ZBUG-3794] CVE-2024-33536 TBD
Unauthenticated Local File Inclusion in zimbraAdmin interface via "packages" parameter [ZBUG-3816] CVE-2024-33535 TBD
Addressed XSS vulnerability in zimbraAdmin interface due to non sanitised parameter [ZBUG-3817] CVE-2024-33533 TBD

What's New

Package Upgrade

  • The Postfix package has been upgraded to 3.6.14

IMPORTANT:
postconf settings are not retained when updating to 10.0.8. Make sure to re-apply any customisations, including TLS cipher configurations you had previously configured using the postconf command.
Please see https://blog.zimbra.com/2023/08/review-your-zimbra-configuration-after-updating-to-the-latest-patch/#comment-152664 for manual steps to re-apply postfix customisations.

  • The PHP package has been upgraded to 8.3.0

Storage Management

Support for compressing blobs stored on S3-compliant external volume has been added. Currently, this can be enabled only via the command line option. Specify -c true when creating a new volume or editing an external volume through CLI. Mailbox restart will be required if editing the volume.

Note: Compression threshold is not honoured for S3 External volume compression.

Modern Web App

General

  • Allow users to accept shared items directly through the Settings > Sharing tab. When a share is pending, a yellow info icon appears, which on click expands to reveal an Accept button. After accepting, the icon disappears, a confirmation message is displayed, and the shared folder becomes visible in the left sidebar.
  • Users now have the ability to accept or reject subscription requests for distribution lists.
  • Optimized the calendar sidebar in the UI to prevent unnecessary re-rendering during navigation, resulting in a smoother user experience with faster event viewing times.
  • Introduced a "Move" option to the context menu for calendar events. Events can now be moved to different calendars, except for their current location or any calendars in trash.

Mail

  • Users can reply and forward emails in plaintext in Modern Web App.

Contacts

  • When a Distribution List is selected from the sidebar under Contacts vertical, members see basic details like name and status, while DL owners view extended attributes.
  • Now, administrators can manage Distribution List members and edit DL properties in the Modern UI.


Fixed Issues

Zimbra Collaboration

  • [ZBUG-2859] To enhance security, when using External LDAP for authentication, the behaviour of authentication of admin accounts has been changed. Earlier, the admin accounts could be authenticated locally with zimbraAuthFallbackToLocal set to FALSE. The behaviour has now been corrected for admin accounts to honour zimbraAuthFallbackToLocal. The local LDAP authentication will fail if zimbraAuthFallbackToLocal is set to FALSE.
    • It is recommended to set zimbraAuthFallbackToLocal FALSE when using external authentication.
    • If you are unable to add your admin account to your external authentication source, you are recommended to follow the steps here
  • With OpenJDK 17.08, there was issue with mailbox threads not closing gracefully when External LDAP was not reachable. We have fixed issue by enabling concurrent socket connection. [ZBUG-3987]
  • zimbra-zimlet-sticky-notes zimlet is now part of the Zimbra repo. This will make it easy for the customers to upgrade the zimlet whenever an updated version is released. [ZBUG-3911]
  • On an iOS device, multiple response email is sent to the organizer when a user deletes the meeting invite from Inbox and Trash, and tries to accept the meeting from the Calendar app. The issue has been fixed. [ZBUG-3866]
  • Mailbox service crashes If a corrupted attachment file is encountered when indexing. The issue has been fixed and the scenario is now handled gracefully. [ZBUG-3863]
  • Optimized the API calls to fetch data of a particular calendar event when the remote calendar is synced to the device and the device sends multiple requests [ZBUG-3827]
  • Appointments set to the 'Europe/Dublin' timezone were displaying with a one-hour error in Zimbra. This has been fixed to show the correct times. [ZBUG-3216]

Modern Web App

General

  • In the Modern UI, when composing an email, users experienced an issue where right-clicking to paste content into the body of the email was not functioning as expected. This has been resolved to ensure right-click functionality is consistent across the application, allowing for content to be pasted as intended. [ZBUG-3995]
  • Users noticed that while misspelled words were underlined in red, right-clicking did not prompt a context menu for spellcheck options. This issue has been fixed to ensure that right-clicking on a misspelled word will bring up the browser's spellcheck as expected on both the Compose and Reply screens. [ZBUG-3942]
  • Issue with SVG file attachments being truncated when downloading all attachments in the Modern Web Client have been addressed. [ZBUG-3868]
  • An issue has been resolved in the Modern UI where viewing emails sometimes caused content from previously selected emails to overlap with the content of a newly selected email. [ZBUG-3844]
  • Users were experiencing issues with copying public links to the clipboard in the Briefcase on Chrome, Chromium, and Edge browsers. This issue has been fixed now. [ZBUG-3638]
  • In the email compose settings, there was an issue where the font list was getting cut off, making it impossible to select the "Roboto" font. This has been corrected to ensure all font options are fully visible and selectable. [ZBUG-3570]
  • Resolved an intermittent issue where an error toast stating "No such message exist" would incorrectly display after successfully sending an email.


Zimbra Connector for Outlook

  • If an Outlook Profile or Outlook is set to a different language than ZCO, then when sending an email through a Draft folder, it appears empty to the recipient. The issue has been fixed. [ZBUG-3972]


HSM

  • After performing an in-place upgrade to Daffodil v10 and while migrating the Storage Management configuration, the migration failed if the setup had any orphaned mailboxes. A check has now been added to skip the orphaned mailboxes and migrate the configuration. [ZBUG-3914]


Things to Know Before Upgrading

Important Upgrade Instructions for Daffodil v10 version older than build 10.0.0_GA_4452

If you are currently using the Beta version build of Daffodil v10 (10.0.0_GA_4452), please follow these upgrade instructions:

  • Upgrade to the latest GA Version build 10.0.0_GA_4518: It is crucial to first upgrade to the latest GA version before proceeding with any further updates. This latest GA release includes essential updates, including modifications to the database schema and various other feature improvements. Upgrade will also install latest 10.0 patch packages.

By following this upgrade path, you ensure that your system is properly updated, incorporating the necessary database schema changes and other critical updates introduced in the latest GA build.

Please review the following information to decide if Zimbra Daffodil (v10) is suitable for you.

  • Zimbra Touch Client, Zimbra Mobile Client, and Zimbra HTML (Standard) Client are no longer a part of Zimbra starting from Version 9.0.0.
  • A Zimbra Network Edition license is required to use Zimbra Daffodil (v10).
  • The customizations implemented for SAML and SPNEGO will be overridden during an upgrade. It is recommended to backup these configurations before upgrading the server.
  • In case of rolling upgrades, if some mailstore nodes are upgraded to zimbra-10 and some mailstore nodes are on Zimbra 9.0.x or Zimbra 8.8.15 then, zimbraReverseProxyUpstreamLoginServers should only contain the list of Zimbra 10.0.0 mailboxes. If this is not followed then in some cases, users on zimbra-10 mailstore nodes will not be able to see Modern Web App after login.
  • Zimbra (v10) continues to support two versions of Zimbra Web Client -- Modern and Classic.
    • To know more about the highlights of the Modern Web App, please refer to Introducing the Modern Web Application
    • The Classic Web App offers the same functionality as the Advanced Web Client in Zimbra version 8.8.15.
    • Existing customized themes, logo branding changes, and crontab changes are incompatible with, and hence do not reflect in the Modern Web App. Branding needs to be re-configured to work with the Modern Web App. The Modern Web App does not currently support themes. Please refer to the Customizing Modern Web App section of Admin Guide for more information related to configuration.
    • Zimlets are supported on both the Web Clients.
    • Zimlets that work with the Classic Web App are incompatible with the Modern Web App. And due to technology changes, there is no way to migrate the Zimlets from the Classic Web App to the Modern Web App or vice-versa.
  • For Non-NG setups, recommendations when using mailbox move (through zmmboxmove utility) on Rolling-Upgrade environment:
    • Always take full backup *before* doing zmmboxmove.
    • If using Storage Management with primary and secondary storage as Internal, then set zimbraMailboxMoveSkipBlobs and zimbraMailboxMoveSkipHsmBlobs attributes to FALSE before doing zmmboxmove.
    • Always recommended to run HSM and move blobs to current primary/secondary volumes in case of multiple primary/secondary volumes present in the system before doing zmmboxmove.
    • zmmboxmove command should be run from Zimbra (v10) mailbox server.

After you review the tasks in this section, please go to Upgrade Instructions.


Known Issues

  • When upgrading to Zimbra 10 using the rolling upgrade mechanism, if a user on Zimbra 10 shares a Briefcase file with a user on Zimbra 9, then while UI will display a 'Permission denied' error to the user on Zimbra 10, the user on Zimbra 9 still ends up receiving an email that the file has been shared. Even though the mail is received by the Zimbra 9 user, they will not be able to access the file, as the file sharing feature is not available in Zimbra 9.
  • During Rolling Upgrade to Zimbra 10, a user on Zimbra 9 may share a Briefcase folder with a Zimbra 10 user. However, since files were not shared with Zimbra 10 user, the files within the shared folder are not accessible to the Zimbra 10 users.
  • During Rolling Upgrade to Zimbra 10 from Zimbra 9/8.x having NG modules installed, when a Zimbra 9/8.x user creates new files from Briefcase, it results in a error "TypeError: g is null".
  • During Rolling Upgrade to Zimbra 10, a user on Zimbra 10 may share a file with a Zimbra 9 user. However, Zimbra 9 user will not be able to access the file from the shared URL.
  • Zimbra inheritance is followed when setting LDAP attributes. When using Backup & Restore->Message recovery settings from Admin UI, if the value of zimbraDumpsterEnabled attribute is FALSE at COS level and TRUE at Domain level, then the value at COS level will be considered. So the issue here is- adding Domains in the message recovery settings will have no impact on message recovery if the COS level attribute is set to its default value FALSE.
  • Backup and Restore - When mail-store server is restored after moving some of its accounts to another mail store, then old mail data like blobs, metadata, etc. of the accounts which have been moved to another mail store, will also get restored. The workaround is to - execute the restore with --ignoreRedoErrors OR with -rf options like zmrestore -a all --ignoreRedoErrors
  • When user clicks on a file in Briefcase, a preview is displayed for the supported file formats. User can also edit these files in a separate window. The changes take a long time to be reflected in the preview, and sometimes user might need to click on the file multiple times to view the changes.
  • When editing documents from Briefcase, the documents are opened in a separate browser window in which users can edit the document. However, the updated contents are not reflected in the Briefcase file, unless the separate browser window is not closed by the user.
  • User is not able to search files in the "Files shared with me" folder, within Briefcase.
  • Re-sending a file share for a Briefcase document throws the error, "A network service error has occurred".


Modern Web App

Contacts

  • Clicking on Settings Icon after exporting contacts causes the user interface to freeze. To fix it, reload the page.

Admin Web Console

  • In Admin UI, if two users are assigned the Administrator privilege followed by "Assign default domain administrator views and rights", there is an error displayed for the second user, and the request is not completed. This happens due to a caching issue, and flushing the cache of the mail-store resolves this issue.

ActiveSync

  • On iOS Native App, if the Mail, Calendar, and Contacts folders are shared with the user, the shares are not displayed on the App.

Similarly, for Windows Outlook and Windows Native Contacts App, if the Contacts folder is shared with the user, the shares are not displayed on the App. Workaround - The user will have to reconfigure his account on the device to get the shares mounted on the device.

  • Exchange ActiveSync protocol currently does not support Read-Only permission sharing. It is recommended not to enable Sharing for the users having shares with Read-Only permission.
  • In a Rolling-upgrade environment, if a zimbra-9 user shares a calendar with zimbra-10 user, the events are not synced.

Workaround - For the Rolling-Upgrade environment involving the NG mailbox server, due to technical differences between the NG Mobile feature and Zimbra (v10) Mobile Sync feature, it is recommended to use Sharing feature after moving all the accounts to zimbra-10 mailbox server.

  • For Windows Mail App, the Sent folder emails are not displayed after blocking and unblocking the user.

Workaround - The user can remove and reconfigure the account on the app.

  • When using iOS Outlook App, Out of Office settings are not synced to the user's account in Web App.
  • When the organizer and attendee use the Outlook app, if the organizer cancels an instance from a recurring meeting, the same is not reflected on the attendee's calendar.

Backup Restore

  • When using backup and restore to move data from source 9.x NG server to destination 10.x server, if both the source and destination, primary volumes are 'External', and zimbraBackupSkipBlobs is set to True, then emails moved secondary volume throw 'Missing Blob for item' error.
  • When an account is restored using backup data from NG external secondary volume, the account is displaying garbled data for emails on the destination server.
  • When we schedule backup using zmschedulebackup command, backup is getting scheduled in crontab and LDAP attributes are updated with appropriate values.

HSM

  • On the NG server, if you are using OpenIO as an external volume to store your Primary/Secondary data and do an in-place upgrade to Patch 10.0.5, then the emails present on the OpenIO store appear garbled. Currently, no workaround is available for this issue and our engineering team is working on it.


Packages

The package lineup for this release is: 

zimbra-patch                                      ->  10.0.8.1713174662-2
zimbra-mta-patch                                  ->  10.0.8.1712912158-1
zimbra-proxy-patch                                ->  10.0.8.1712912158-1
zimbra-ldap-patch                                 ->  10.0.8.1712912158-1
zimbra-mbox-admin-console-war                     ->  10.0.8.1712903884-1
zimbra-timezone-data                              ->  4.0.0.1712904550-1
zimbra-mbox-webclient-war                         ->  10.0.8.1712904967-1
zimbra-common-core-jar                            ->  10.0.8.1712908620-1
zimbra-zimlet-sticky-notes                        ->  1.0.0.1710232258-1
zimbra-postfix                                    ->  3.6.14-1zimbra8.7b4
zimbra-mta-components                             ->  1.0.23-1zimbra8.8b1
zimbra-php                                        ->  8.3.0-1zimbra8.7b3
zimbra-apache-components                          ->  2.0.12-1zimbra8.8b1
zimbra-spell-components                           ->  2.0.13-1zimbra8.8b1, 2.0.14-1zimbra8.8b1 ( for RHEL8 and Ubuntu 20 )
zimbra-modules-porter                             ->  1.0.0.1712500730-1
zimbra-zco                                        ->  9.0.0.1942.1712913066-1
zimbra-modern-ui                                  ->  4.37.0.1713166554-1
zimbra-modern-zimlets                             ->  4.37.0.1713166554-1
zimbra-zimlet-additional-signature-setting        ->  9.1.1.1713165868-1
zimbra-zimlet-calendar-subscription               ->  7.2.1.1713165868-1
zimbra-zimlet-date                                ->  7.2.1.1713165868-1
zimbra-zimlet-emptysubject                        ->  3.2.1.1713165868-1
zimbra-zimlet-org-chart                           ->  3.2.1.1713165868-1
zimbra-zimlet-set-default-client                  ->  10.3.1.1713165868-1
zimbra-zimlet-user-sessions-management            ->  10.2.1.1713165868-1
zimbra-zimlet-classic-set-default-client          ->  1.0.0.1713165868-1
zimbra-zimlet-document-editor                     ->  11.3.0.1713165868-1


Patch Installation

Please refer to below link to install 10.0.8:

Installation


Quick note: Open Source repo

The steps to download, build, and see our code via Github can be found here: https://github.com/Zimbra/zm-build



Try Zimbra

Try now Zimbra Collaboration without any cost with the 60-day free Trial.
Get it now »

Want to get involved?

You can contribute in the Community, in the Wiki, in the Code, or developing Zimlets.
Find out more. »

Other Help Resources

Visit the User Help Page »
Visit the Official Forums »
Zimbra Documentation Page »

Looking for a Video?

Visit our YouTube Channel to keep posted about Webinars, technology news, Product overviews and more.
Go to the YouTube Channel »

Retrieved from "http://wiki.zimbra.com/index.php?title=Zimbra_Releases/10.0.8&oldid=70450"
Jump to: navigation, search