Patch Severity: High. This release addresses critical bug fixes and essential security updates Patch Release for the following editions Zimbra Daffodil 10.0.6 (Release Notes) Zimbra 9.0.0 Kepler Patch-38 (Release Notes) Zimbra 8.8.15 Joule Patch-45 (Release Notes) Patch updated on 18 Dec include the following in their respective releases What’s New OpenJDK has been upgraded to […]
Archive | Security & Privacy
How to stay informed about Zimbra security announcements?
Zimbra can be updated using apt update or yum update, and it is highly recommended to install Zimbra updates (patches) as they are released, especially in case of patches that include security fixes. Here are a few ways to stay informed on Zimbra Security updates: Subscribe to these RSS feeds: https://wiki.zimbra.com/security-advisory-feed.php (no details, can be […]
Patch for Zimbra Daffodil 10.0.5, 9.0.0 Patch-37 & 8.8.15 Patch-44
Daffodil Migration Patch: Assist Users in Moving to Daffodil This patch has newly added functions that will aid in the upgrade/migration process to Daffodil. To safeguard your system, we recommend you always upgrade to the latest patch and regularly refer to our blog and the Zimbra Security Center for steps to ensure your system is safe. Patch Release […]
Zimbra not affected by NGINX CVE-2023-44487
Recently a number of partners have asked if Zimbra is affected by NGINX CVE-2023-44487. When we take a look at the NGINX blog post on CVE-2023-44487 it mentions the following: …it is essential that the following updates are made to NGINX configuration files, minimizing the server’s attack surface: keepalive_requests should be kept at the default […]
What are the benefits of using Zimbra OpenSSL in FIPS mode?
If you installed or upgraded to Zimbra version 9.0.0.P34, 8.8.15.P41, 10.0.2 or higher, Zimbra will use OpenSSL 3.0.x and FIPS compliance for OpenSSL will be enabled by default. To check if your Zimbra OpenSSL is using FIPS you can run the following command, that should fail with Error setting digest: /opt/zimbra/common/bin/openssl md5 /dev/null There are […]
Patch for Zimbra Daffodil 10.0.4, 9.0.0 Patch-36 & 8.8.15 Patch-43
Guarding Against XSS: Security Update This Patch Release is for the following editions Daffodil 10.0.4 9.0.0 Kelper Patch 36 8.8.15 Joule Patch 43 This notification is published ahead of the actual release to enable administrators to schedule time to install the patch. The patch has been released on Wednesday (13 Sept). The steps for installing […]