Zimbra Releases/9.0.0/P31

Revision as of 06:07, 17 March 2023 by Deepak.gautam (talk | contribs)

Zimbra Collaboration Kepler 9.0.0 Patch 31 GA Release

Check out the Security Fixes, What's New, and Known Issues for this version of Zimbra Collaboration. Please refer to the Patch Installation page for Patch Installation instructions. As always, you are encouraged to tell us what you think in the Forums or open a support ticket to report issues

NOTICE: MTA Patch version

As part of this patch, we are releasing the updated ClamAV and its related packages which are installed only on MTA nodes. Since this patch will not get installed on other nodes (e.g. Mailbox, LDAP), it will continue to display the previously installed patch versions as Patch 9.0.0_P30.

If patch 29 or older are currently installed on your server, please ensure you review Patch 30 release notes to obtain all updates on all components.

Security Fixes

Summary CVE-ID CVSS Score Zimbra Rating
The ClamAV package has been upgraded to version 0.105.2 to fix multiple vulnerabilities CVE-2023-20032 9.8 Critical

Note: Additional configuration for further hardening your Zimbra setup can be found on the Zimbra Support Portal. It is recommended that all customers consider these additional steps. If someone had applied this configuration previously, then after upgrading to this patch, they will have to re-apply the same configuration.

What's New

Package Upgrade

  • ClamAV package has been upgraded from 0.105.1-2 to version 0.105.2

Known Issues

  • While deploying zimlets, if the following error is encountered, please refer to the Patch Installation page to install the zimbra-common-core-jar, zimbra-common-core-libs, zimbra-mbox-store-libs packages in a particular order and re-deploy the zimlets.
/opt/zimbra/bin/zmjava: line 59: /bin/java: No such file or directory
Exception in thread "main" java.lang.NoClassDefFoundError: org/apache/logging/log4j/core/appender/ConsoleAppender$Target
       at com.zimbra.cs.localconfig.LocalConfigCLI.main(LocalConfigCLI.java:353)
Caused by: java.lang.ClassNotFoundException: org.apache.logging.log4j.core.appender.ConsoleAppender$Target
       at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:602)
       at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
       at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521)
       ... 1 more
  • From Kepler-Patch-25 onwards, customers using SSO will need to update zimbraVirtualHostName attribute for the domains. Please refer to the instructions to update the attribute.
  • With JDK 17, weaker Kerberos encryption types like 3DES and RC4 have now been disabled by default. This can cause SPNEGO auth to fail if described encryption types are being used. We recommend using stronger encryption types like AES256.

To get SPNEGO auth working with weak encryption types, weak encryption can be enabled by setting the allow_weak_crypto property to true in the krb5.conf configuration file. Please follow below instructions:

1. In /opt/zimbra/jetty_base/etc/krb5.ini.in -> [libdefaults] section, set allow_weak_crypto = true

2. Restart mailboxd service:

su - zimbra
zmmailboxdctl restart


The package lineup for this release is:

zimbra-mta-patch                                  ->
zimbra-mta-components                             ->  1.0.19-1zimbra8.8b1
zimbra-clamav                                     ->  0.105.2-1zimbra8.8b3

Patch Installation

Please refer to the steps below to install Kepler 9.0.0 Patch 31 on Redhat and Ubuntu platforms:

Before Installing the Patch, consider the following:

  • Patches are cumulative.
  • A full backup should be performed before any patch is applied. There is no automated roll-back.
  • Switch to zimbra user before using ZCS CLI commands.
  • Important! You cannot revert to the previous ZCS release after you upgrade to the patch.
  • Important Note for ZCS Setup with Local ZCS repository: Customers who have set up local ZCS repository should first update the local repository by following instructions in wiki


Install/Upgrade zimbra-mta-patch on MTA node

  • As root, install the package:
yum install zimbra-mta-patch
  • Restart ZCS as zimbra user:
su - zimbra
zmcontrol restart


Install/Upgrade zimbra-mta-patch on MTA node

  • As root, install package
apt-get install zimbra-mta-patch
  • Restart ZCS as zimbra user:
su - zimbra
zmcontrol restart
Jump to: navigation, search