Date: Fri, 26 Jul 2019 12:00:06 +0200 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead On Mon, Jul 22, 2019 at 12:00:13PM +0200, Heiko Schlittermann wrote: > *** Note: EMBARGO is still in effect until July 25th, 10:00 UTC. *** > *** Distros must not publish any detail nor release updates yet. *** Somehow there isn't a proper message from Exim maintainers in here yet, but the release is out, so I feel I have to take over and post this for them: https://lists.exim.org/lurker/message/20190725.090419.d506f736.en.html --- Author: Jeremy Harris Date: 2019-07-25 11:04 +200 To: exim-announce, exim users Subject: [exim] CVE-2019-13917 General release information =========================== The code fix for this issue has been placed in the project public git repository; the project website will be updated in due course. CVE ID: CVE-2019-13917 OVE ID: OVE-20190718-0006 Date: 2019-07-18 Credits: Jeremy Harris Version(s): 4.85 up to and including 4.92 Issue: A local or remote attacker can execute programs with root privileges - if you've an unusual configuration. For details see below. Coordinated Release Date (CRD) for Exim 4.92.1: Thu Jul 25 10:00:00 UTC 2019 Contact: security@??? Details: A vulnerability was discovered in the "sort" expansion operator: The elements of the list were expanded, giving a possible attack if the list included data supplied by an attacker. If the effective configuration file for exim does not use sort then the system is trivially declarable as not being vulnerable. Use this command to check: "exim -bP config | grep sort". - -- Cheers, Jeremy --- Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.