Guarding Against XSS: Security Update
This Patch Release is for the following editions
This notification is published ahead of the actual release to enable administrators to schedule time to install the patch.
The patch has been released on Wednesday (13 Sept).
The steps for installing this patch can be found in the release notes linked above.
There seems to be an encoding issue in several .js files in zimbra-mbox-webclient-war since this patch. The diff looks like:
– //Only the server will set ZmSetting.TWO_FACTOR_AUTH_ENABLED. Don’t try to save the setting from the UI.
+ //Only the server will set ZmSetting.TWO_FACTOR_AUTH_ENABLED. Don???t try to save the setting from the UI.
Notice how the non-ASCII apostrophe gets replaced with “???”
While this doesn’t matter in a comment, there may be other encoding issues in different places…
The corresponding source file didn’t change: https://github.com/Zimbra/zm-web-client/blame/develop/WebRoot/js/zimbraMail/share/view/dialog/ZmTwoFactorSetupDialog.js
So the encoding error was probably introduced while building/packaging.
This character encoding issue only affects four comments through the entire zimbra-mbox-webclient-war package, so I think this is safe to apply. The root cause should be identified to avoid possible future problems, though.
Also, in the UI this build is labeled “8.8.15_GA_3”, whereas previous version was “8.8.15_GA_4545”, with always increasing GA build number. This seems wrong as well?
Also, while removing the Docs.jsp file, shouldn’t the patch also remove the corresponding jetty/work/zimbra/jsp/org/apache/jsp/public_/Docs_jsp.* files, as was done for hostedlogin.jsp in the previous patch ?
can you share the ZCS version and OS details ?
Hi Geert,
After a thorough review of all the details, we have determined that there are no significant impacts resulting from the encoding issues.
The encoding change is a byproduct of our build process, and our team is actively working to resolve it in the next patch release. Importantly, this encoding issue does not affect the functionality of the system.
Regarding Docs.JSP and other files, the security issue is from the JSP file only and the JSP file is the entry point. After the previous patch, we validated these issues and found no impact from other files.
Thank you for your feedback. If you have any further questions or concerns, please let us know.