Use 'zmprov' (the correct command name) instead of 'zmprove' (wrong)

[robert-scheck]

Please use at least the correct command name: zmprov. Meanwhile this advisory is also known as CVE-2022-32294.

Aside of this, I'm unable to reproduce the issue. And unfortunately your description how to reproduce this possible security flaw is incomplete. Based on the official Zimbra administration guidelines, I assumed the following steps:

1. assumed step:

# su - zimbra
$ zmprov ca tux@example.net ""
5db256d6-9bdc-45ac-b2da-04bd42018406
$ 

2. assumed step: Initial random password should be revealed in /var/log/secure (RHEL/Rocky Linux, or where ever sudo calls are logged) – but zmprov by itself does not call sudo at all, and I can not find any hint about a password for my above example user tux@example.net in any syslog file or elsewhere within the syslog stack.

Further on: If this security flaw really exists, but was just accidentially described incompletely, it mainly applies by default only to Zimbra multi-server setups with remote syslog, or to regular setups with manually configured remote syslog. On default Zimbra single-server setups without any manually configured remote syslog, the password is not transmitted to foreign systems.

Most likely the sudo calls in your screenshot (copied in below) are caused by a third-party application, but not by Zimbra.