Summary
It was discovered that Exim did not enforce STARTTLS sync point on client
side. An attacker could possibly use this issue to perform response
injection during MTA SMTP sending.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | exim4 | 4.93-13ubuntu1.11 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | exim4 | 4.82-3ubuntu2.4+esm8 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | exim4 | 4.86.2-2ubuntu2.6+esm7 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | exim4 | 4.90.1-1ubuntu1.10+esm4 |
Vulnerabilities 1
-
Unscored —
The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.
References
-
report
https://ubuntu.com/security/CVE-2021-38371