<![CDATA[iRedMail — SOGO XML parsing failures]]> https://forum.iredmail.org/topic18780-sogo-xml-parsing-failures.html Wed, 09 Mar 2022 13:41:27 +0000 PunBB <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82404.html#p82404 Just run "yum" or "apt" tool to upgrade sogo and its dependent packages will fix the issue.

]]> Wed, 09 Mar 2022 13:41:27 +0000 https://forum.iredmail.org/post82404.html#p82404 <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82376.html#p82376 New packages are available from https://packages.inverse.ca/SOGo/

]]> Fri, 04 Mar 2022 06:30:28 +0000 https://forum.iredmail.org/post82376.html#p82376 <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82371.html#p82371 Is there a time frame that EAS will come back to alive?

]]> Thu, 03 Mar 2022 12:55:26 +0000 https://forum.iredmail.org/post82371.html#p82371 <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82365.html#p82365 Can confirm that downgrading libexpat1 works. Should have found this post earlier, would have saved me a couple of hours.

]]> Tue, 01 Mar 2022 16:23:56 +0000 https://forum.iredmail.org/post82365.html#p82365 <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82363.html#p82363 libwbxml author released a patched version libwbxml 0.11.8
therefore the new version should be available in the official packages in Debian soon i guess

in the meantime, if you like, the libwbxml.c author provides a community repository with packages for the latest version of SOGo
https://www.axis.cz/linux/debian/pool/sogo-v5/w/wbxml2/
be sure to pick the correct distro

i tested on my debian 11 system and it works fine with the latest libexpat1:
wget ..... libwbxml2-0_0.11.8-0debian11+0_amd64.deb
dpkg -i libwbxml2-0_0.11.8-0debian11+0_amd64.deb

apt-mark unhold libexpat1
apt install libexpat1

]]> Tue, 01 Mar 2022 12:18:45 +0000 https://forum.iredmail.org/post82363.html#p82363 <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82358.html#p82358 My bad. Yes iRedmail 1.5.1 which includes Roundcube upgrade to version 1.5.2.

]]> Mon, 28 Feb 2022 05:21:56 +0000 https://forum.iredmail.org/post82358.html#p82358 <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82356.html#p82356 plantagenet82 wrote:

Upgraded to Sogov5 and iRedmail 1.5.2.

There is no iRedMail 1.5.2, I guess you meant RoundCubeMail 1.5.2 ?

]]> Sun, 27 Feb 2022 08:55:37 +0000 https://forum.iredmail.org/post82356.html#p82356 <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82353.html#p82353 Can confirm same issue with AWS EC2 Ubuntu 18.04. Sogo v4.

#apt-get install libexpat1=2.2.5-3 libexpat1-dev=2.2.5-3
#apt-mark hold libexpat1

Back up and working.

Upgraded to Sogov5 and iRedmail 1.5.2.

]]> Sun, 27 Feb 2022 08:09:05 +0000 https://forum.iredmail.org/post82353.html#p82353 <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82336.html#p82336 to summarize up:

Keep in mind that when you are downgrading, you are doing rollback to a package version with known security vulnerabilities CVE-2022-25236 (NIST Score 9.8/critical):
(Description: xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs)

Patching of this security vulnerability ended up in incompatibilty between libwbxml and Expat >=2.4.5
"libwbxml is using : (colon) for a namespace separator"  & "Expat disallows use of namespace separator characters in xmlns attribute values for security since 2.4.5"

Therefore new bug tracking for this issue is openend on github and needs resolving, you can follow up here if you like:
https://github.com/libwbxml/libwbxml/issues/78

]]> Fri, 25 Feb 2022 08:55:31 +0000 https://forum.iredmail.org/post82336.html#p82336 <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82331.html#p82331 alec wrote:

I tried that but after restarting sogo, nginx was responding with Error 502 to users that were trying to login from browser.

Any error in SOGo log file /var/log/sogo/sogo.log?

]]> Fri, 25 Feb 2022 08:46:53 +0000 https://forum.iredmail.org/post82331.html#p82331 <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82324.html#p82324 ZhangHuangbin wrote:

For Ubuntu 20.04 users, please downgrade to libexpat1_2.2.9-1build1, then restart sogo service.
For example:

wget http://us.archive.ubuntu.com/ubuntu/pool/main/e/expat/libexpat1_2.2.9-1build1_amd64.deb
dpkg -i libexpat1_2.2.9-1build1_amd64.deb
service sogo restart

For Debian 11 users, please downgrade to 2.2.6-2+deb10u1.

I tried that but after restarting sogo, nginx was responding with Error 502 to users that were trying to login from browser.

]]> Thu, 24 Feb 2022 15:48:52 +0000 https://forum.iredmail.org/post82324.html#p82324 <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82323.html#p82323 For Debian 10 users, steps to downgrade:

===
sudo apt install libexpat1=2.2.6-2+deb10u1
sudo apt-mark hold libexpat1
===

Please note that the second line will hold the package at this specific version until hold is removed.

]]> Thu, 24 Feb 2022 15:29:35 +0000 https://forum.iredmail.org/post82323.html#p82323 <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82322.html#p82322 User "FoZo" shared the downgrade steps with "apt-get" command here:
https://www.sogo.nu/bugs/view.php?id=5486

]]> Thu, 24 Feb 2022 15:26:44 +0000 https://forum.iredmail.org/post82322.html#p82322 <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82321.html#p82321 For Ubuntu 20.04 users, please downgrade to libexpat1_2.2.9-1build1, then restart sogo service.
For example:

wget http://us.archive.ubuntu.com/ubuntu/pool/main/e/expat/libexpat1_2.2.9-1build1_amd64.deb
dpkg -i libexpat1_2.2.9-1build1_amd64.deb
service sogo restart

For Debian 11 users, please downgrade to 2.2.6-2+deb10u1.

]]> Thu, 24 Feb 2022 15:23:31 +0000 https://forum.iredmail.org/post82321.html#p82321 <![CDATA[Re: SOGO XML parsing failures]]> https://forum.iredmail.org/post82320.html#p82320 I can confirm that it works after downgrading that package. No apparent side effects for now.

BTW: Thanks Zhang, both for the heads-up and for following the ticket on sogo.nu lists.

]]> Thu, 24 Feb 2022 15:04:49 +0000 https://forum.iredmail.org/post82320.html#p82320