Date: Tue, 4 Jun 2019 15:25:34 +0200 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit On Mon, Jun 03, 2019 at 10:19:23PM +0200, Heiko Schlittermann wrote: > CVE-2019-10149 Exim 4.87 to 4.91 > ================================ > > We received a report of a possible remote exploit. Currently there is no > evidenice of an active use of this exploit. > > A patch exists already, is being tested, and backported to all > versions we released since (and including) 4.87. > > The severity depends on your configuration. It depends on how close to > the standard configuration your Exim runtime configuration is. The > closer the better. > > Exim 4.92 is not vulnerable. I guess I wasn't the only one wondering how revealing this is, so: $ diff -urwx doc exim-4.91 exim-4.92 | diffstat -s 131 files changed, 6898 insertions(+), 4395 deletions(-) $ diff -urwx doc exim-4.91 exim-4.92 | wc 27635 114347 935620 exim-4.92/doc/ChangeLog lists tens of changes. Exim 4.92 appears to have been released in February, when the security issue referred to here was not yet known as such, so this wasn't a deliberate decision to release the fix publicly yet keep it unmentioned. Keeping the issue in this semi-public state for 7 days feels weird to me, but given the above it doesn't look too unrealistic that the issue won't be rediscovered during this time period. (The risk of leaks is probably higher.) It'd be curious if someone ends up discovering a different and yet unknown security issue by reading that diff. ;-) Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.