Zammad 7.2.3

🚨 Wichtiger Hinweis zum Update

Anpassung der nginx-/Apache2-Konfiguration erforderlich

Wenn Sie nginx oder Apache2 verwenden, bitte passen Sie Ihre Konfiguration an und ergänzen Sie den Header Remote-User zusätzlich zum bestehenden Header X-Forwarded-User.

Fügen Sie dazu die folgende Zeile in Ihre Konfigurationsdatei ein:

nginx:

# change this line in an SSO setup
proxy_set_header X-Forwarded-User "";
proxy_set_header Remote-User "";

Apache2:

# change this line in an SSO setup
RequestHeader unset X-Forwarded-User
RequestHeader unset Remote-User

Wichtig bei SSO-Konfigurationen: Stellen Sie sicher, dass Ihr Reverse Proxy genau einen der beiden Header (X-Forwarded-User oder Remote-User) setzt und den jeweils anderen entfernt.

Docker-Nutzer: Es sind keine weiteren Schritte erforderlich. Die Konfigurationsänderung wird in den Docker-Images automatisch vorgenommen.

Empfohlene Maßnahme

SaaS-Kunden: Es sind keine Schritte erforderlich. Unsere SaaS-Instanzen wurden bereits auf Zammad 7.2.3 aktualisiert.

Selbst gehostete Installationen: Wir empfehlen dringend, Ihr System umgehend auf die neueste Zammad-Version zu aktualisieren, um den Schutz Ihrer Instanz sicherzustellen.

Behobene Sicherheitslücken

Alle technischen Details finden Sie in den Security Advisories auf GitHub.

• Encrypted or signed incoming email could reintroduce privileged headers past the untrusted-mail filter
• Sender identity spoofing via headers inside encrypted or signed emails
• Disclosure of user profile data to customer-privileged accounts via the ticket creation form
• Maintenance mode was not enforced on real-time connections
• HTML injection in WhatsApp reaction notification emails
• AI-generated ticket field values could disclose protected system settings
• Unauthenticated creation of administrator accounts during a data migration
• Disclosure of internal service responses via external authentication profile images
• Delegated text module and trigger managers could read protected system settings
• Unauthenticated memory exhaustion via crafted image attachments
• Agents can read arbitrary ticket articles via online notifications
• Agents could receive ticket notifications shortly after role-based group access was revoked
• Overview cache could disclose tickets to users without access
• Customers kept receiving live updates of shared-organization tickets after leaving the organization
• Organization list disclosure to customers without organization
• Partial admin permissions allowed changing restricted system settings and account takeover
• Session identifier still disclosed through GraphQL session and login responses
• Remote image tracking and API path bypass via backslash URLs in HTML sanitizer
• Remote content and API path bypass via inline styles in HTML sanitizer
• Account takeover via client-controlled identity in SSO authentication
• Agents could remove links to objects they had no access to
• Channel type restriction bypass for partial channel administrators
• Revoked and refreshed OAuth2 tokens remained usable
• GitLab API token stored in clear text in the HTTP log
• Disclosure of inaccessible tickets via checklist references
• Knowledge base search showed answers from restricted categories to editors
• Public knowledge base feed disclosed titles of non-public categories
• Missing limit on failed two-factor attempts allows brute-forcing the second factor
• API token permission restrictions not applied to live update pushes
• Cross-site request forgery in realtime update endpoint
• Live updates of macros and AI text tools disclosed their identifiers and group assignments to all logged-in users
• Partial administrators could replace the product logo
• Denial of Service via Unauthenticated Websocket Message
• Partial administrators could add unchecked options to system settings
• Partial administrators could run unintended server components via core workflows
• Administrators could replace internal components of system settings, incl. password authentication
• AI-generated knowledge base drafts could be saved into categories the agent was not allowed to edit
• Memory corruption in Ruby's regular expression compiler via administrator-configured patterns
• Agent sessions disclosed macros and AI text tools of all groups
• Customer ticket search matches content of internal articles
• Delegated administrators could read stored records and credentials through template placeholders
• Partial administrators could delete records and read restricted data via core workflow conditions
• Customers could delete shared ticket drafts prepared by agents