affect Exim's operation, with an unchanged configuration file. For new
options, and new features, see the NewStuff file next to this ChangeLog.
+Exim version 4.95
+-----------------
+
+JH/01 Move the wait-for-next-tick (needed for unique messmage IDs) from
+ after reception to before a subsequent reception. This should
+ mean slightly faster delivery, and also confirmation of reception
+ to senders.
+
+JH/02 Move from using the pcre library to pcre2. The former is no longer
+ being developed or supported (by the original developer).
+
+JH/03 Constification work in the filters module required a major version
+ bump for the local-scan API. Specifically, the "headers_charset"
+ global which is visible via the API is now const and may therefore
+ not be modified by local-scan code.
+
+JH/04 Fix ClamAV TCP use under FreeBSD. Previously the OS-specific shim for
+ sendfile() didi not account for the way the ClamAV driver code called it.
+
+JH/05 Bug 2819: speed up command-line messages being read in. Previously a
+ time check was being done for every character; replace that with one
+ per buffer.
+
+JH/06 Bug 2815: Fix ALPN sent by server under OpenSSL. Previously the string
+ sent was prefixed with a length byte.
+
+JH/07 Change the SMTP feature name for pipelining connect to be compliant with
+ RFC 5321. Previously Dovecot (at least) would log errors during
+ submission.
+
+JH/08 Remove stripping of the binaries from the FreeBSD build. This was added
+ in 4.61 without a reason logged. Binaries will be bigger, which might
+ matter on diskspace-constrained systems, but debug is easier.
+
+JH/09 Fix macro-definition during "-be" expansion testing. The move to
+ write-protected store for macros had not accounted for these runtime
+ additions; fix by removing this protection for "-be" mode.
+
+JH/10 Convert all uses of select() to poll(). FreeBSD 12.2 was found to be
+ handing out large-numbered file descriptors, violating the usual Unix
+ assumption (and required by Posix) that the lowest possible number will be
+ allocated by the kernel when a new one is needed. In the daemon, and any
+ child procesees, values higher than 1024 (being bigger than FD_SETSIZE)
+ are not useable for FD_SET() [and hence select()] and overwrite the stack.
+ Assorted crashes happen.
+
+JH/11 Fix use of $sender_host_name in daemon process. When used in certain
+ main-section options or in a connect ACL, the value from the first ever
+ connection was never replaced for subsequent connections. Found by
+ Wakko Warner.
+
+JH/12 Bug 2838: Fix for i32lp64 hard-align platforms. Found for SPARC Linux,
+ though only once PCRE2 was introduced: the memory accounting used under
+ debug offset allocations by an int, giving a hard trap in early startup.
+ Change to using a size_t. Debug and fix by John Paul Adrian Glaubitz.
+
+JH/13 Bug 2845: Fix handling of tls_require_ciphers for OpenSSL when a value
+ with underbars is given. The write-protection of configuration introduced
+ in 4.95 trapped when normalisation was applied to an option not needing
+ expansion action.
+
+JH/14 Bug 1895: TLS: Deprecate RFC 5114 Diffie-Hellman parameters.
+
+JH/15 Fix a resource leak in *BSD. An off-by-one error resulted in the daemon
+ failing to close the certificates directory, every hour or any time it
+ was touched.
+
+JH/16 Debugging initiated by an ACL control now continues through into routing
+ and transport processes, when delivery is immediate. Previously debugging
+ stopped any time Exim re-execs.
+
+JH/17 The "expand" debug selector now gives more detail, specifically on the
+ result of expansion operators and items.
+
+JH/18 Bug 2751: Fix include_directory in redirect routers. Previously a
+ bad comparison between the option value and the name of the file to
+ be included was done, and a mismatch was wrongly identified.
+ 4.88 to 4.95 are affected.
+
+JH/19 Support for Berkeley DB versions 1 and 2 is withdrawn.
+
+JH/20 When built with NDBM for hints DB's check for nonexistence of a name
+ supplied as the db file-pair basename. Previously, if a directory
+ path was given, for example via the autoreply "once" option, the DB
+ file.pag and file.dir files would be created in that directory's
+ parent.
+
Exim version 4.95
-----------------
JH/07 Bug 2597: Fix a resource leak. Using a lookup in obtaining a value for
smtp_accept_max_per_host allocated resources which were not released
when the limit was exceeded. This eventually crashed the daemon. Fix
- by adding a relase action in that path.
+ by adding a release action in that path.
JH/08 Bug 2598: Fix verify ACL condition. The options for the condition are
expanded; previously using tainted values was rejected. Fix by using
JH/16 Bug 2615: Fix pause during message reception, on systems that have been
suspended/resumed. The Linux CLOCK_MONOTONIC does not account for time
- spent suspended, ignoring the Posix definition. Previously we assumed
+ spent suspended, ignoring the POSIX definition. Previously we assumed
it did and a constant offset from real time could be used as a correction.
Change to using the same clock source for the start-of-message and the
post-message next-tick-wait. Also change to using CLOCK_BOOTTIME if it
JH/17 Bug 2295: Fix DKIM signing to always semicolon-terminate. Although the
RFC says it is optional some validators care. The missing char was not
- intended but triggered by a line-wrap alignement. Discovery and fix by
+ intended but triggered by a line-wrap alignment. Discovery and fix by
Guillaume Outters, hacked on by JH.
JH/18 Bug 2617: Fix a taint trap in parse_fix_phrase(). Previously when the
name being quoted was tainted a trap would be taken. Fix by using
- dynamicaly created buffers. The routine could have been called by a
+ dynamically created buffers. The routine could have been called by a
rewrite with the "h" flag, by using the "-F" command-line option, or
by using a "name=" option on a control=submission ACL modifier.
JH/30 Bug 2677: fix matching of long addresses. Since 4.93 a limit of 256 was
applied. This resulted, if any header-line rewrite rules were configured,
- in a panic-log trigerrable by sending a message with a long address in
- a header. Fix by increaing the arbitrary limit to larger than a single
+ in a panic-log triggerable by sending a message with a long address in
+ a header. Fix by increasing the arbitrary limit to larger than a single
(dewrapped) 5322 header line maximum size.
JH/31 The ESMTP option name advertised for the SUPPORT_EARLY_PIPE build option
is changed from X_PIPE_CONNECT to PIPE_CONNECT. This is in line with
RFC 6648 which deprecates X- options in protocols as a general practice.
Changeover between the implementations is handled by the mechanisms
- alrready coded.
+ already coded.
JH/32 Bug 2599: fix delay of delivery to a local address where there is also
a remote which uses callout/hold. Previously the local was queued.
JH/38 When logging an AUTH failure, as server, do not include sensitive
information. Previously, the credentials would be included if given
- as part of the AUTH command line and an ACL denied authentidcation.
+ as part of the AUTH command line and an ACL denied authentication.
JH/39 Bug 2691: fix $local_part_data. When the matching list element
referred to a file, bad data was returned. This likely also affected
transport executions. This also mean that the log lines for the
messages can show the proxy information.
-JH/50 Bug 2672: QT elements in log lines, unless disabled, now exclude the
+JH/50 Bug 2672: QT elements in log lines, unless disabled, now exclude the
receive time. With modern systems the difference is significant.
The historical behaviour can be restored by disabling (a new) log_selector
"queue_time_exclusive".
JH/51 Taint-check ACL line. Previously, only filenames (for out-of-line ACL
- content) were specifically tested for. Now, also cover epxansions
- rerulting in acl names and inline ACL content.
+ content) were specifically tested for. Now, also cover expansions
+ resulting in ACL names and inline ACL content.
JH/52 Fix ${ip6norm:} operator. Previously, any trailing line text was dropped,
making it unusable in complex expressions.
providing a particularly obnoxious sender full name.
Reported by Qualys.
+PP/06 Fix CVE-2020-28016 (PFPZA): Heap out-of-bounds write in parse_fix_phrase()
+
+PP/07 Refuse to allocate too little memory, block negative/zero allocations.
+ Security guard.
+
+PP/08 Change default for recipients_max from unlimited to 50,000.
+
+PP/09 Fix security issue with too many recipients on a message (to remove a
+ known security problem if someone does set recipients_max to unlimited,
+ or if local additions add to the recipient list).
+ Fixes CVE-2020-RCPTL reported by Qualys.
+
+PP/10 Fix security issue in SMTP verb option parsing
+ Fixes CVE-2020-EXOPT reported by Qualys.
+
+PP/11 Fix security issue in BDAT state confusion.
+ Ensure we reset known-good where we know we need to not be reading BDAT
+ data, as a general case fix, and move the places where we switch to BDAT
+ mode until after various protocol state checks.
+ Fixes CVE-2020-BDATA reported by Qualys.
+
+HS/03 Die on "/../" in msglog file names
+
+QS/01 Creation of (database) files in $spool_dir: only uid=0 or the uid of
+ the Exim runtime user are allowed to create files.
+
+QS/02 PID file creation/deletion: only possible if uid=0 or uid is the Exim
+ runtime user.
+
+QS/03 When reading the output from interpreted forward files we do not
+ pass the pipe between the parent and the interpreting process to
+ executed child processes (if any).
+
+QS/04 Always die if requested from internal logging, even is logging is
+ disabled.
+
+JH/54 DMARC: recent versions of the OpenDMARC library appear to have broken
+ the API; compilation noo longer completes with DMARC support included.
+ This affects 1.4.1-1 on Fedora 33 (1.3.2-3 is functional); and has
+ been reported on other platforms.
+
+JH/55 TLS: as server, reject connections with ALPN indicating non-smtp use.
+
+JH/56 Make the majority of info read from config files readonly, for defence-in-
+ depth against exploits. Suggestion by Qualys.
+ Not supported on Solaris 10.
+
+JH/57 Fix control=fakreject for a custom message containing tainted data.
+ Previously this resulted in a log complaint, due to a re-expansion present
+ since fakereject was originally introduced.
+
+JH/58 GnuTLS: Fix certextract expansion. If a second modifier after a tag
+ modifier was given, a loop resulted.
+
+JH/59 DKIM: Fix small-message verification under TLS with chunking. If a
+ pipelined SMTP command followed the BDAT LAST then it would be
+ incorrectly treated as part of the message body, causing a verification
+ fail.
+
+JH/60 Bug 2805: Fix logging of domain-literals in Message_ID: headers. They
+ require looser validation rules than those for 821-level addresses,
+ which only permit IP addresses.
+
Exim version 4.94
-----------------
to do ARC verification. The Authentication-Results: header line added
by the configuration then had no ARC item.
+JH/48 Bug 2784: fix shutdown=no in the ${readsocket) expansion item. Previously
+ an incorrect mode was used for reading the result, resulting in it being
+ ignored.
+
Exim version 4.92
-----------------
git://git.exim.org / exim.git / blobdiff