Fix SPA authenticator, checking client-supplied data before using it. Bug 2571

[exim.git] / doc / doc-txt / ChangeLog

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 1d685a1308b0771722a34e0d0b00d23828c1104d..6109a14dd69433016ad56560fa90f54b79d4f2f4 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -184,6 +184,11 @@ JH/40 Fix a memory-handling bug: when a connection carried multiple messages
       stale data could be accessed.  Ensure that variable references are
       dropped between messages.
 
+JH/41 Bug 2571: Fix SPA authenticator.  Running as a server, an offset supplied
+      by the client was not checked as pointing within response data before
+      being used.  A malicious client could thus cause an out-of-bounds read and
+      possibly gain authentication.  Fix by adding the check.
+
 
 Exim version 4.93
 -----------------