affect Exim's operation, with an unchanged configuration file. For new
options, and new features, see the NewStuff file next to this ChangeLog.
+Exim version 4.98
+-----------------
+
+JH/01 Support list of dkim results in the dkim_status ACL condition, making
+ it more usable in the data ACL.
+
+JH/02 Bug 3040: Handle error on close of the spool data file during reception.
+ Previously This was only logged, on the assumption that errors would be
+ seen for a previous fflush(). However, a fuse filesystem has been
+ reported as showing this an error for the fclose(). The spool is now in
+ an uncertain state, and we have logged and responded acceptance. Change
+ this to respond with a temp-reject, wipe spoolfiles, and log the error
+ detail.
+
+JH/03 Bug 3030: Fix handling of DNS servfail respons for DANE TLSA. When hit
+ during a recipient verify callout, a QUIT command was attempted on the
+ now-closed callout channel, causing a paniclog entry.
+
+JH/04 Bug 3039: Fix handling of of an empty log_reject_target, with
+ a connection_reject log_selector, under tls_on_connect. Previously
+ with this combination, when the connect ACL rejected, a spurious
+ paniclog entry was made.
+
+JH/05 Fix TLS resumption for TLS-on-connect. This was broken by the advent
+ of loadbalancer-detection for resumption, in 4.96 - which tries to
+ use the EHLO response. SMTPS does not have one at the time it is starting
+ TLS. Change the default for the smtp transport host_name_extract option
+ to be a static string, for TLS-on-connect cases; meaning that resumption
+ will always be attempted (unless deliberately overriden).
+
+JH/06 Bug 3054: Fix dnsdb lookup for a TXT record with multiple chunks, with a
+ chunk-separator specification. This was broken by hardening introduced
+ for Bug 3031.
+
+JH/07 Bug 3050: Fix -bp for old message_id format spoolfiles. Previously it
+ included the -H with the id; this also messed up exiqgrep.
+
+JH/08 Bug 3056: Tighten up parsing of DKIM DNS records. Previously, whitespace
+ was not properly skipped and empty elements would cause mis-parsing.
+ Tighten parsing of DKIM header records. Previously, all but lowercase
+ alpha chars would be ignored in potential tag names.
+
+JH/09 Bug 3057: Add heuristic for spotting mistyped IPv6 addresses in lists
+ being searched. Previously we only had one for IPv4 addresses. Per the
+ documentation, the error results by default in a no-match result for the
+ list. It is logged if the unknown_in_list log_selector is used.
+
+JH/10 Bug 3058: Ensure that a failing expansion in a router "set" option defers
+ the routing operation. Previously it would silently stop routing the
+ message.
+
+JH/11 Bug 3046: Fix queue-runs. Previously, the arrivel of a notification or
+ info-request event close in time to a scheduled run timer could result in
+ the latter being missed, and no further queue scheduled runs being
+ initiated. This ouwld be more likely on high-load systems.
+
+JH/12 Enforce a data synch check before emitting the 354 "go ahead". Previously
+ this was only done if a pre-data ACL was configured.
+
+JH/13 Refuse to accept a line "dot, LF" as end-of-DATA unless operating in
+ LF-only mode (as detected from the first header line). Previously we did
+ accept that in (normal) CRLF mode; this has been raised as a possible
+ attack scenario (under the name "smtp smuggling").
+
+
+
Exim version 4.97
-----------------
JH/19 Bug 2911: Fix a recursion in DNS lookups. Previously, if the main option
dns_again_means_nonexist included an element causing a DNS lookup which
- iteslf returned DNS_AGAIN, unbounded recursion occurred. Possible results
+ itself returned DNS_AGAIN, unbounded recursion occurred. Possible results
included (though probably not limited to) a process crash from stack
memory limit, or from excessive open files. Replace this with a paniclog
whine (as this is likely a configuration error), and returning
JH/32 Fix "tls_dhparam = none" under GnuTLS. At least with 3.7.9 this gave
a null-indirection SIGSEGV for the receive process.
-JH/33 Fix free for live variable $value created by a ${run ...} expansion.
- Although not seen, this could have resulted in a SIGSEGV.
+JH/33 Fix free for live variable $value created by a ${run ...} expansion during
+ -bh use. Internal checking would spot this and take a panic.
+
+JH/34 Bug 3013: Fix use of $recipients within arguments for ${run...}.
+ In 4.96 this would expand to empty.
+
+JH/35 Bug 3014: GnuTLS: fix expiry date for an auto-generated server
+ certificate. Find and fix by Andreas Metzler.
+
+JH/36 Add ARC info to DMARC hostory records.
+
+JH/37 Bug 3016: Avoid sending DSN when message was accepted under fakereject
+ or fakedefer. Previously the sender could discover that the message
+ had in fact been accepted.
+
+JH/38 Taint-track intermediate values from the peer in multi-stage authentation
+ sequences. Previously the input was not noted as being tainted; notably
+ this resulted in behaviour of LOGIN vs. PLAIN being inconsistent under
+ bad coding of authenticators.
+
+JH/39 Bug 3023: Fix crash induced by some combinations of zero-length strings
+ and ${tr...}. Found and diagnosed by Heiko Schlichting.
+
+JH/40 Bug 2999: Fix a possible OOB write in the external authenticator, which
+ could be triggered by externally-supplied input. Found by Trend Micro.
+ CVE-2023-42115
+
+JH/41 Bug 3000: Fix a possible OOB write in the SPA authenticator, which could
+ be triggered by externally-controlled input. Found by Trend Micro.
+ CVE-2023-42116
+
+JH/42 Bug 3001: Fix a possible OOB read in the SPA authenticator, which could
+ be triggered by externally-controlled input. Found by Trend Micro.
+ CVE-2023-42114
+
+JH/43 Bug 2903: avoid exit on an attempt to rewrite a malformed address.
+ Make the rewrite never match and keep the logging. Trust the
+ admin to be using verify=header-syntax (to actually reject the message).
+
+JH/44 Bug 3033: Harden dnsdb lookups against crafted DNS responses.
+ CVE-2023-42219
+
+HS/02 Fix string_is_ip_address() CVE-2023-42117 (Bug 3031)
Exim version 4.96
git://git.exim.org / exim.git / blobdiff