DKIM: Fix signing for body lines starting with a pair of dots. Bug 2284

[exim.git] / doc / doc-txt / ChangeLog

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 236ccae8b54ad6abbb1d698f6d783c35f0084f96..da162a04f17ecd55311d46ca2bebdbdfbb4c9dec 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -5,15 +5,53 @@ affect Exim's operation, with an unchanged configuration file.  For new
 options, and new features, see the NewStuff file next to this ChangeLog.
 
 
 options, and new features, see the NewStuff file next to this ChangeLog.
 
 

-Since Exim version 4.90
------------------------
+Since version 4.91
+------------------
+
+JH/02 Bug 1007: Avoid doing logging from signal-handlers, as that can result in
+      non-signal-safe functions being used.
+
+JH/03 Bug 2269: When presented with a received message having a stupidly large
+      number of DKIM-Signature headers, disable DKIM verification to avoid
+      a resource-consumption attack.  The limit is set at twenty.
+
+JH/05 Bug 2273: Cutthrough delivery left a window where the received messsage
+      files in the spool were present and unlocked.  A queue-runner could spot
+      them, resulting in a duplicate delivery.  Fix that by doing the unlock
+      after the unlink.  Investigation by Tim Stewart.
+
+JH/06 Bug 2275: The MIME ACL unlocked the received message files early, and
+      a queue-runner could start a delivery while other operations were ongoing.
+      Cutthrough delivery was a common victim, resulting in duplicate delivery.
+      Found and investigated by Tim Stewart.  Fix by using the open message data
+      file handle rather than opening another, and not locally closing it (which
+      releases a lock) for that case, while creating the temporary .eml format
+      file for the MIME ACL.  Also applies to "regex" and "spam" ACL conditions.
+
+JH/08 When generating a selfsigned cert, use serial number 1 since zero is not
+      legitimate.
+
+JH/09 Bug 2274: Fix logging of cmdline args when starting in an unlinked cwd.
+      Previously this would segfault.
+
+JH/10 Fix ARC signing for case when DKIM signing failed.  Previously this would
+      segfault.
+
+JH/14 Bug 2284: Fix DKIM signing for body lines starting with a pair of dots.
+
+
+Exim version 4.91
+-----------------

 
 GF/01 DEFER rather than ERROR on redis cluster MOVED response.
 
 GF/01 DEFER rather than ERROR on redis cluster MOVED response.

-     When redis_servers is set to a list of > 1 element, and the Redis servers
-     in that list are in cluster configuration, convert the REDIS_REPLY_ERROR
-     case of MOVED into a DEFER case instead, thus moving the query onto the
-     next server in the list. For a cluster of N elements, all N servers must
-     be defined in redis_servers.
+      When redis_servers is set to a list of > 1 element, and the Redis servers
+      in that list are in cluster configuration, convert the REDIS_REPLY_ERROR
+      case of MOVED into a DEFER case instead, thus moving the query onto the
+      next server in the list. For a cluster of N elements, all N servers must
+      be defined in redis_servers.
+
+GF/02 Catch and remove uninitialized value warning in exiqsumm
+      Check for existence of @ARGV before looking at $ARGV[0]

 
 JH/01 Replace the store_release() internal interface with store_newblock(),
       which internalises the check required to safely use the old one, plus
 
 JH/01 Replace the store_release() internal interface with store_newblock(),
       which internalises the check required to safely use the old one, plus


@@ -145,9 +183,9 @@ JH/28 Ensure that variables possibly set during message acceptance are marked
       dead before release of memory in the daemon loop.  This stops complaints
       about them when the debug_store option is enabled.  Discovered specifically
       for sender_rate_period, but applies to a whole set of variables.
       dead before release of memory in the daemon loop.  This stops complaints
       about them when the debug_store option is enabled.  Discovered specifically
       for sender_rate_period, but applies to a whole set of variables.

-      Do the same for the queue-runner loop, for variables set from spool
-      message files.  Do the same for the SMTP per-message loop, for certain
-      variables indirectly set in ACL operations.
+      Do the same for the queue-runner and queue-list loops, for variables set
+      from spool message files.  Do the same for the SMTP per-message loop, for
+      certain variables indirectly set in ACL operations.

 
 JH/29 Bug 2250: Fix a longstanding bug in heavily-pipelined SMTP input (such
       as a multi-recipient message from a mailinglist manager).  The coding had
 
 JH/29 Bug 2250: Fix a longstanding bug in heavily-pipelined SMTP input (such
       as a multi-recipient message from a mailinglist manager).  The coding had


@@ -165,6 +203,53 @@ JH/30 The (EXPERIMENTAL_DMARC) variable $dmarc_ar_header is withdrawn, being
 
 JH/31 Bug 2257: Fix pipe transport to not use a socket-only syscall.
 
 
 JH/31 Bug 2257: Fix pipe transport to not use a socket-only syscall.
 

+HS/03 Set a handler for SIGTERM and call exit(3) if running as PID 1. This
+      allows proper process termination in container environments.
+
+JH/32 Bug 2258: Fix spool_wireformat in combination with LMTP transport.
+      Previously the "final dot" had a newline after it; ensure it is CR,LF.
+
+JH/33 SPF: remove support for the "spf" ACL condition outcome values "err_temp"
+      and "err_perm", deprecated since 4.83 when the RFC-defined words
+      "temperror" and "permerror" were introduced.
+
+JH/34 Re-introduce enforcement of no cutthrough delivery on transports having
+      transport-filters or DKIM-signing.  The restriction was lost in the
+      consolidation of verify-callout and delivery SMTP handling.
+      Extend the restriction to also cover ARC-signing.
+
+JH/35 Cutthrough: for a final-dot response timeout (and nonunderstood responses)
+      in defer=pass mode supply a 450 to the initiator.  Previously the message
+      would be spooled.
+
+PP/02 DANE: add dane_require_tls_ciphers SMTP Transport option; if unset,
+      tls_require_ciphers is used as before.
+
+HS/03 Malware Avast: Better match the Avast multiline protocol. Add
+      "pass_unscanned".  Only tmpfails from the scanner are written to
+      the paniclog, as they may require admin intervention (permission
+      denied, license issues). Other scanner errors (like decompression
+      bombs) do not cause a paniclog entry.
+
+JH/36 Fix reinitialisation of DKIM logging variable between messages.
+      Previously it was possible to log spurious information in receive log
+      lines.
+
+JH/37 Bug 2255: Revert the disable of the OpenSSL session caching.  This
+      triggered odd behaviour from Outlook Express clients.
+
+PP/03 Add util/renew-opendmarc-tlds.sh script for safe renewal of public
+      suffix list.
+
+JH/38 DKIM: accept Ed25519 pubkeys in SubjectPublicKeyInfo-wrapped form,
+      since the IETF WG has not yet settled on that versus the original
+      "bare" representation.
+
+JH/39 Fix syslog logging for syslog_timestamp=no and log_selector +millisec.
+      Previously the millisecond value corrupted the output.
+      Fix also for syslog_pid=no and log_selector +pid, for which the pid
+      corrupted the output.
+

 
 Exim version 4.90
 -----------------
 
 Exim version 4.90
 -----------------