Add more detail to the mitigation
authorHeiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Fri, 6 Sep 2019 11:18:14 +0000 (13:18 +0200)
committerHeiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Fri, 6 Sep 2019 11:18:14 +0000 (13:18 +0200)
templates/static/doc/security/CVE-2019-15846.txt

index aabdf1d9da933fb309d8535626e738381daee029..386a1fab29943bfd483b03600aaa6531d35c543e 100644 (file)
@@ -29,8 +29,10 @@ Do not offer TLS. (This mitigation is not recommended.)
 
 For a attacking SNI the following ACL snippet should work:
 
-    # to be prepended to your mail acl (acl_smtp_mail)
+    # to be prepended to your mail acl (the ACL referenced
+    # by the acl_smtp_mail main config option)
     deny    condition = ${if eq{\\}{${substr{-1}{1}{$tls_in_sni}}}}
+    deny    condition = ${if eq{\\}{${substr{-1}{1}{$tls_in_peerdn}}}}
 
 Fix
 ===