There were some areas in Danish translations which needed corrections.Apache has been upgraded from 2.4.51 to 2.4.53.PHP has been upgraded from 7.3.25 to 7.4.27.Memcached poisoning with unauthenticated request. RCE through mboximport from authenticated user. Upgraded PHP to 7.4.27 to avoid DoS vulnerability.Īn endpoint URL accepts parameters without sanitizing it caused XSS vulnerability. Upgraded Apache to 2.4.53 to avoid multiple vulnerabilities. Please watch for more updates in the upcoming release. CVE-2022-23302: Zimbra is not vulnerable to this vulnerability, since it does not run the JMSSink.Įven though Zimbra is not affected by the Log4j vulnerabilities, we are in the process of updating Log4j to a version that is not affected.CVE-2022-23305: Zimbra is not vulnerable to this vulnerability, since it does not run the JDBCAppender.To be exploited the system must be running Chainsaw. CVE-2022-23307: Zimbra is vulnerable but is not exploitable.

For this vulnerability to affect the server, it needs JMSAppender and the ability to append configuration files. CVE-2021-4104: This RedHat vulnerability does not affect the current Supported Zimbra Collaboration Server versions (8.8.15 & 9.0.0).The cause of the vulnerability is found in the lookup expression feature in Log4j versions 2.0 to 2.17.įollowing are some more updates on the existing and newly reported vulnerabilities: Zimbra Collaboration Server currently uses Log4j version 1.2.16.

After intensive review and testing, Zimbra Development determined that the zero-day exploit vulnerability for Log4j (CVE-2021-44228) does not affect the current Supported Zimbra versions (9.0.0 & 8.8.15).

Modern CSV 2.0.4 for iphone instal