X-Git-Url: https://git.exim.org/exim-website.git/blobdiff_plain/3c78bd2faccc7516a63a0fc1dac75b8c5256adf6..29ed6255443ddd8c3248415c80201169e4f2e8a4:/templates/static/doc/security/CVE-2019-15846.txt

diff --git a/templates/static/doc/security/CVE-2019-15846.txt b/templates/static/doc/security/CVE-2019-15846.txt
index 3a78aa5..f82b8e3 100644
--- a/templates/static/doc/security/CVE-2019-15846.txt
+++ b/templates/static/doc/security/CVE-2019-15846.txt
@@ -27,6 +27,13 @@ Mitigation
 
 Do not offer TLS. (This mitigation is not recommended.)
 
+For a attacking TLS client the following ACL snippet should work:
+
+    # to be prepended to your mail acl (the ACL referenced
+    # by the acl_smtp_mail main config option)
+    deny    condition = ${if eq{\\}{${substr{-1}{1}{$tls_in_sni}}}}
+    deny    condition = ${if eq{\\}{${substr{-1}{1}{$tls_in_peerdn}}}}
+
 Fix
 ===