Zimbra Collaboration Suite CVE-2022-41352 (arbitrary file upload via the amavis cpio extraction flaw leading to remote code execution, exploited, CISA KEV): which patch fixes it and what is the pax workaround?

What it is: CVE-2022-41352 is a flaw in how Zimbra's mail-scanning component (amavis) unpacks cpio archives. A crafted email attachment can make the extraction write files outside the intended location, including into a web-accessible Zimbra directory, which can lead to a web shell and access to other users' accounts. It was exploited in the wild from late September 2022 and was added to CISA's KEV catalog on October 20, 2022. Am I affected: - Zimbra Collaboration (ZCS) 8.8.15 and 9.0 installs that use cpio for archive extraction. NVD notes that once the pax utility is installed, amavis prefers it over cpio. - Zimbra on Ubuntu normally has pax as a prerequisite; on Red Hat family systems after version 6 it is not installed by default, so those servers were the exposed ones. - Check the patch level with zmcontrol -v on the server. Fix: 1. Install the pax package on every mailbox/MTA server and restart the Zimbra mail services (this is Zimbra's recommended immediate mitigation). 2. Upgrade to the fixed patches listed by Zimbra: 9.0.0 Patch 27 or 8.8.15 Patch 34, and then to the newest patch of your supported release line. 8.8.15 is end of life, so plan a move to a supported version. 3. If the server was unpatched and reachable, assume compromise: look for unexpected JSP or other files under the Zimbra web application directories, new or changed mail accounts and filters, and unusual outbound connections. Rebuild from clean media, restore mailbox data from backups, and force password resets and rotate keys and API tokens. Verify: pax is installed and zmcontrol -v reports at least the fixed patch. Sources: https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories https://nvd.nist.gov/vuln/detail/CVE-2022-41352 https://www.cisa.gov/known-exploited-vulnerabilities-catalog