Zimbra Collaboration Joule 8.8.15 Patch 41 GA Release

Release Date: July 26, 2023

Check out the Security Fixes, What's New, Fixed Issues, and Known Issues for this version of Zimbra Collaboration. Please refer to the Patch Installation steps for Patch Installation instructions. As always, you are encouraged to tell us what you think in the Forums or open a support ticket to report issues.

NOTE: If you are upgrading or migrating from an older version of Zimbra to Zimbra 8.8 Production Ready, please read Things to Know Before Upgrading and First Steps with the Zimbra NG Modules for critical information before you upgrade.

IMPORTANT: To install LDAP component standalone

The ZCS installer script has been updated to fix an issue related to deploying the certificate when installing the LDAP component. If you are planning to do a fresh install on a new server, please download the latest installer tar from the Zimbra Downloads page.

IMPORTANT: Zimbra OpenSSL with default FIPS Configuration

Please be advised that, TLS 1.2 is the minimum supported version if FIPS is being used with OpenSSL 3.0. We recommend using Zimbra with strong TLS configuration for increased security. Please follow instructions in Cipher-suites-wiki to set correct ciphers as per current versions of openssl, nginx and postfix.

From this patch going forward Zimbra OpenSSL will be configured to work with FIPS compliance enabled by default. You do not need to take any action, unless you run into issues, you can switch to the non-FIPS provider as follows:

Run the below commands to Enable/Disable FIPS providers on all servers.

Disable FIPS provider:

As root user run below commands

Take backup of openssl.cnf
cd /opt/zimbra/common/etc/ssl
cp openssl.cnf <backup-path>/openssl.cnf

Copy openssl-source.cnf file
cd /opt/zimbra/common/etc/ssl
cp openssl-source.cnf openssl.cnf

Verify that, FIPS provider is disabled:
Run below command and verify fips provider is not listed
/opt/zimbra/common/bin/openssl list --providers

As zimbra user run below commands
su - zimbra
zmcontrol restart

Enable FIPS provider:

As root user run below commands

Take backup of openssl.cnf
cd /opt/zimbra/common/etc/ssl
cp openssl.cnf <backup-path>/openssl.cnf

Copy openssl-fips.cnf file
cd /opt/zimbra/common/etc/ssl
cp openssl-fips.cnf openssl.cnf

Verify that, FIPS provider is enabled:
Run below command and verify fips provider is listed
/opt/zimbra/common/bin/openssl list --providers

As zimbra user run below commands
su - zimbra
zmcontrol restart

Change in upgrade process for 8.8.15 Patch 41

Please note that the install process has changed. Additional steps to install zimbra-common-core-jar, zimbra-common-core-libs, zimbra-mbox-store-libs packages have been included for this patch release. Please refer to the Patch Installation steps to install the packages in its order.

Changes required for SSO setup before patch upgrade

Before upgrade, we need to set the zimbraVirtualHostName parameter for the domains that are using SAML and SSO based login. Please follow the instructions:

su - zimbra
zmprov md domain_name zimbraVirtualHostName virtual_hostname

Security Fixes

Summary	CVE-ID	CVSS Score
OpenSSL package has been upgraded to fix a security issue related to the verification of X.509 certificate chains that include policy constraints	CVE-2023-0464	TBD
The Amavis package has been upgraded to 2.13.0 version.	TBD	TBD
A cross-site scripting (XSS) vulnerability that was present in the in the Zimbra Classic Web Client has been addressed.	CVE-2023-37580	TBD
A bug that could lead to exposure of internal JSP and XML files has been fixed.	CVE-2023-38750	TBD

Note: Additional configuration for further hardening your Zimbra setup can be found on the Zimbra Support Portal. It is recommended that all customers consider these additional steps.

What's New

Package Upgrade

The OpenSSL package has been upgraded from 1.1.1t to 3.0.9
The Amavis package has been upgraded from 2.10.1 to 2.13.0
The Clamav package has been upgraded from 0.105.2 to 1.0.1
The Crypt::OpenSSL::RSA package has been upgraded from 0.31 to 0.33
The IO::Socket::SSL package has been upgraded from 2.068 to 2.083
The LWP::Protocol::https package has been upgraded from 6.06 to 6.10
The Mail::DKIM package has been upgraded from 0.40 to 0.43
The Net::SSLeay package has been upgraded from 1.88 to 1.92
The Unbound package has been upgraded from 1.11 to 1.17.1

Zimbra Connector for Outlook

The Zimbra Free Busy provider has been set as a default Free Busy provider. It will now display the correct status color for Busy, Tentative, and Out Of Office meetings. Earlier, it was set to Internet Free Busy provider.

Fixed Issues