Zimbra Collaboration Daffodil 10.0.9 Patch Release

Release Date: September 04, 2024

IMPORTANT: Admin Account authentication now honors zimbraAuthFallbackToLocal when using external/custom authentication. See: https://blog.zimbra.com/2024/04/admin-account-authentication-now-honors-zimbraauthfallbacktolocal/

Check out the Security Fixes, What's New, Fixed Issues, Things to Know Before Upgrading and Known Issues sections for this version of Zimbra Collaboration. Please refer to the Patch Installation steps for Patch Installation instructions. As always, you are encouraged to tell us what you think in the Forums or open a support ticket to report issues.

IMPORTANT: Instructions to update Zimbra's onlyoffice repository for installing zimbra-onlyoffice package.

Please note that there is no change in the onlyoffice package. Add Zimbra's onlyoffice repository to the server before Zimbra Daffodil v10 installation/upgrade. These repos will be included bydefault in upcoming Zimbra Daffodil version.

https://repo.zimbra.com/apt/onlyoffice

https://repo.zimbra.com/rpm/onlyoffice

You must add your local repository to your RHEL/CentOS Configuration :

Redhat

RHEL7

$ cat > /etc/yum.repos.d/zimbra-onlyoffice.repo <<EOF
[zimbra-onlyoffice]
name=Zimbra Onlyoffice RPM Repository
baseurl=https://repo.zimbra.com/rpm/onlyoffice/rhel7
gpgcheck=1
enabled=1
EOF

RHEL8

$ cat > /etc/yum.repos.d/zimbra-onlyoffice.repo <<EOF
[zimbra-onlyoffice]
name=Zimbra Onlyoffice RPM Repository
baseurl=https://repo.zimbra.com/rpm/onlyoffice/rhel8
gpgcheck=1
enabled=1
EOF

rpm --import https://files.zimbra.com/downloads/security/public.key
yum --disablerepo=* --enablerepo=zimbra-onlyoffice clean metadata
yum check-update --disablerepo=* --enablerepo=zimbra-onlyoffice --noplugins

Ubuntu

UBUNTU18

$ cat > /etc/apt/sources.list.d/zimbra-onlyoffice.list << EOF
deb [arch=amd64] https://repo.zimbra.com/apt/onlyoffice bionic zimbra
deb-src [arch=amd64] https://repo.zimbra.com/apt/onlyoffice bionic zimbra
EOF

UBUNTU20

$ cat > /etc/apt/sources.list.d/zimbra-onlyoffice.list << EOF
deb [arch=amd64] https://repo.zimbra.com/apt/onlyoffice focal zimbra
deb-src [arch=amd64] https://repo.zimbra.com/apt/onlyoffice focal zimbra
EOF

apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 9BE6ED79
apt-get update

IMPORTANT: Incase above steps are missed for Onlyoffice installation, following is the manual steps for installation.

As root user run below commands: (assuming Zimbra is already installed)

$ wget -O /opt/zimbra/bin/zmonlyofficeinstall https://raw.githubusercontent.com/Zimbra/zm-core-utils/10.0.9/src/bin/zmonlyofficeinstall
$ chmod 755 /opt/zimbra/bin/zmonlyofficeinstall
$ /opt/zimbra/bin/zmonlyofficeinstall

IMPORTANT: Zimbra OpenSSL with default FIPS Configuration

Please be advised that, TLS 1.2 is the minimum supported version if FIPS is being used with OpenSSL 3.0. We recommend using Zimbra with strong TLS configuration for increased security. Please follow instructions in Cipher-suites-wiki to set correct ciphers as per current versions of openssl, nginx and postfix.
From this patch going forward Zimbra OpenSSL will be configured to work with FIPS compliance enabled by default. You do not need to take any action, unless you run into issues, you can switch to the non-FIPS provider as follows:

Run below commands to Enable/Disable FIPS providers on all servers.

Disable FIPS provider:

As root user run below commands

Take backup of openssl.cnf
cd /opt/zimbra/common/etc/ssl
cp openssl.cnf <backup-path>/openssl.cnf

Copy openssl-source.cnf file
cd /opt/zimbra/common/etc/ssl
cp openssl-source.cnf openssl.cnf

Verify that, FIPS provider is disabled:
Run below command and verify fips provider is not listed
/opt/zimbra/common/bin/openssl list --providers

As zimbra user run below commands
su - zimbra
zmcontrol restart

Enable FIPS provider:

As root user run below commands

Take backup of openssl.cnf
cd /opt/zimbra/common/etc/ssl
cp openssl.cnf <backup-path>/openssl.cnf

Copy openssl-fips.cnf file
cd /opt/zimbra/common/etc/ssl
cp openssl-fips.cnf openssl.cnf

Verify that, FIPS provider is enabled:
Run below command and verify fips provider is listed
/opt/zimbra/common/bin/openssl list --providers

As zimbra user run below commands
su - zimbra
zmcontrol restart

Security Fixes

Summary	CVE-ID	CVSS Score
A stored XSS vulnerability in the `contacts/print` endpoint has been addressed.	CVE-2024-45513	TBD
Fixed a security vulnerability in the postjournal service which may allow unauthenticated users to execute commands.	CVE-2024-45519	TBD
A Server-Side Request Forgery (SSRF) vulnerability that allowed unauthorized access to internal services has been addressed.	CVE-2024-45518	TBD
A Cross-Site Scripting (XSS) issue that allowed an attacker to inject and execute malicious code via email account configurations has been resolved.	CVE-2024-45194	TBD
A Cross-Site Scripting (XSS) vulnerability in the `/h/rest` endpoint has been fixed.	CVE-2024-45517	TBD
Resolved Cross-Site Scripting (XSS) vulnerability due to inadequate validation of metadata's Content-Type when importing files into the briefcase, preventing arbitrary JavaScript execution.	CVE-2024-45515	TBD
A Cross-Site Scripting (XSS) vulnerability via crafted HTML content in the Zimbra Classic UI has been fixed.	CVE-2024-45516	TBD
A Cross-Site Scripting (XSS) vulnerability caused by a non-sanitized `packages` parameter has been resolved.	CVE-2024-45514	TBD
A Cross-Site Scripting (XSS) vulnerability via crafted HTML content in the Zimbra Classic UI has been fixed.	TBD	TBD
Fixed a reflected XSS vulnerability in the Briefcase module due to improper sanitization by the OnlyOffice formatter.	CVE-2024-45511	TBD
Fixed a Stored Cross-Site Scripting (XSS) vulnerability in the Briefcase module that could execute malicious code when interacting with folder share notifications.	CVE-2024-45512	TBD
Fixed a stored XSS vulnerability that could lead to unauthorized actions when adding contacts from specially crafted emails.	CVE-2024-45510	TBD
A Cross-Site Scripting (XSS) vulnerability in TinyMCE was addressed in the upgrade from version 7.1.1 to 7.2.0	CVE-2024-38356	Medium

What's New

Modern Web App

General

An option to turn off the deletion of appointments for declined meetings has been implemented. Users can now retain appointments in their calendars even if they decline the meeting.
A PostCSS line return parsing error has been fixed, improving the stability and reliability of the stylesheet processing in the Modern UI.
Implementation of truncated folder names in the Modern UI has been completed. Folder names that are too long will now be truncated appropriately to fit the interface.

Mail

The tap-to-read or select functionality in the mobile mail list has been reconfigured to allow larger tap area. This update improves the user experience by making it easier to interact with emails on mobile devices.
The formatting of footer and signature elements in mobile views has been adjusted for better readability and presentation.
The folder list is no longer shown when composing emails in the Modern UI, reducing cognitive load for user when composing the email and reducing visual clutter.

Admin Web Console

Admin Users can now add or remove devices from databases using the admin UI Home → Configure → Global Settings → Mobile.

Fixed Issues