-CVE ID: CVE-2021-38371
-Date: 2021-08-10
-Version(s): up to and including 4.94.2
-Reporter: Damian Poddebniak, Fabian Ising, Hanno Böck, and Sebastian Schinzel
-Reference: https://nostarttls.secvuln.info/
-Issue: Possible MitM attack on STARTTLS when Exim is *sending* email.
-
-** The Exim developers do not consider this issue as a security problem.
-** Additionally, we do not have any feedback about a successful attack
-** using the scenario described below.
-
-
-Conditions to be vulnerable
-===========================
-
-Versions up to (and including) 4.94.2 are vulnerable when
-*sending* emails via a connection encrypted via STARTTLS.
-
-
-Details
-=======
-
-When Exim acting as a mail client wishes to send a message,
-a Meddler-in-the-Middle (MitM) may respond to the STARTTLS command
-by also sending a response to the *next* command, which Exim will
-erroneously treat as a trusted response.
-
-Source fixed by
-https://git.exim.org/exim.git/commit/1b9ab35f323121aabf029f0496c7227818efad14
-commit 1b9ab35f323121aabf029f0496c7227818efad14
-Author: Jeremy Harris
-Date: Thu Jul 30 20:16:01 2020 +0100
-
-Mitigation
-==========
-
-There is - beside updating the server - no known mitigation.
-
-Fix
-===
-
-Download and build the fixed version 4.95 or a later version
-(4.96 was released in June 2022).