X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/36b600bb776d082be8cdd15c18daed3c29cfda7f..1e9a340c05d7233969637095a8a6378b14de2976:/doc/doc-txt/ChangeLog?ds=inline diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index be07ba625..98c1b05e2 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -3,6 +3,211 @@ affect Exim's operation, with an unchanged configuration file. For new options, and new features, see the NewStuff file next to this ChangeLog. +Since Exim version 4.94 +----------------------- + +JH/02 Bug 2587: Fix pam expansion condition. Tainted values are commonly used + as arguments, so an implementation trying to copy these into a local + buffer was taking a taint-enforcement trap. Fix by using dynamically + created buffers. Similar fix for radius expansion condition. + +JH/03 Bug 2586: Fix listcount expansion operator. Using tainted arguments is + reasonable, eg. to count headers. Fix by using dynamically created + buffers rather than a local. Do similar fixes for ACL actions "dcc", + "log_reject_target", "malware" and "spam"; the arguments are expanded + so could be handling tainted values. + +JH/04 Bug 2590: Fix -bi (newaliases). A previous code rearrangement had + broken the (no-op) support for this sendmail command. Restore it + to doing nothing, silently, and returning good status. + +JH/05 Bug 2593: Fix "vacation" in Exim filter. Previously, when a "once" + record path was given (or the default used) without a leading directory + path, an error occurred on trying to open it. Use the transport's working + directory. + +JH/06 Bug 2594: Change the name used for certificate name checks in the smtp + transport. Previously it was the name on the DNS A-record; use instead + the head of the CNAME chain leading there (if there is one). This seems + to align better with RFC 6125. + +JH/07 Bug 2597: Fix a resource leak. Using a lookup in obtaining a value for + smtp_accept_max_per_host allocated resources which were not released + when the limit was exceeded. This eventually crashed the daemon. Fix + by adding a relase action in that path. + +JH/08 Bug 2598: Fix verify ACL condition. The options for the condition are + expanded; previously using tainted values was rejected. Fix by using + dynamically-created buffers. + +JH/10 Bug 2603: Fix coding of string copying to only evaluate arguments once. + Previously a macro used one argument twice; when called with the + argument as an expression having side-effects, incorrect operation + resulted. Use an inlineable function. + +JH/11 Bug 2604: Fix request to cutthrough-deliver when a connection is already + held open for a verify callout. Previously this wan not accounted for + and a corrupt onward SMTP conversation resulted. + +JH/13 Fix dsearch "subdir" filter to ignore ".". Previously only ".." was + excluded, not matching the documentation. + +JH/14 Bug 2606: Fix a segfault in sqlite lookups. When no, or a bad, filename + was given for the sqlite_dbfile a trap resulted. + +JH/15 Bug 2620: Fix "spam" ACL condition. Previously, tainted values for the + "name" argument resulted in a trap. There is no reason to disallow such; + this was a coding error. + +JH/16 Bug 2615: Fix pause during message reception, on systems that have been + suspended/resumed. The Linux CLOCK_MONOTONIC does not account for time + spent suspended, ignoring the Posix definition. Previously we assumed + it did and a constant offset from real time could be used as a correction. + Change to using the same clock source for the start-of-message and the + post-message next-tick-wait. Also change to using CLOCK_BOOTTIME if it + exists, just to get a clock slightly more aligned to reality. + +JH/17 Bug 2295: Fix DKIM signing to always semicolon-terminate. Although the + RFC says it is optional some validators care. The missing char was not + intended but triggered by a line-wrap alignement. Discovery and fix by + Guillaume Outters, hacked on by JH. + +JH/18 Bug 2617: Fix a taint trap in parse_fix_phrase(). Previously when the + name being quoted was tainted a trap would be taken. Fix by using + dynamicaly created buffers. The routine could have been called by a + rewrite with the "h" flag, by using the "-F" command-line option, or + by using a "name=" option on a control=submission ACL modifier. + +JH/21 Bug 2630: Fix eol-replacement string for the ${readsocket } expansion. + Previously when a whitespace character was specified it was not inserted + after removing the newline. + +JH/24 Bug 2634: Fix a taint trap seen on NetBSD: the testing coded for + is_tainted() had an off-by-one error in the overenthusiastic direction. + Find and fix by Gavan. Although NetBSD is not a supported platform for + 4.94 this bug could affect other platforms. + +JH/24 Bug 2634: Fix a taint trap seen on NetBSD: the testing coded for + is_tainted() had an off-by-one error in the overenthusiastic direction. + Find and fix by Gavan. Although NetBSD is not a supported platform for + 4.94 this bug could affect other platforms. +JH/21 Bug 2630: Fix eol-replacement string for the ${readsocket } expansion. + Previously when a whitespace character was specified it was not inserted + after removing the newline. + +JH/22 Bug 2265: Force SNI usage for smtp transport DANE'd connections, to be + the domain part of the recipient address. This overrides any tls_sni + option set, which was previously used. + +JH/23 Logging: with the +tls_sni log_selector, do not wrap the received SNI + in quotes. + +JH/26 Bug 2646: fix a memory usage issue in ldap lookups. Previously, when more + than one server was defined and depending on the platform memory layout + details, an internal consistency trap could be hit while walking the list + of servers. + +JH/27 Bug 2648: fix the passing of an authenticator public-name through spool + files. The value is used by the authresults expansion item. Previously + if this was used in a router or transport, a crash could result. + +JH/30 Bug 2677: fix matching of long addresses. Since 4.93 a limit of 256 was + applied. This resulted, if any header-line rewrite rules were configured, + in a panic-log trigerrable by sending a message with a long address in + a header. Fix by increaing the arbitrary limit to larger than a single + (dewrapped) 5322 header line maximum size. + +JH/31 The ESMTP option name advertised for the SUPPORT_EARLY_PIPE build option + is changed from X_PIPE_CONNECT to PIPE_CONNECT. This is in line with + RFC 6648 which deprecates X- options in protocols as a general practice. + Changeover between the implementations is handled by the mechanisms + alrready coded. + +JH/32 Bug 2599: fix delay of delivery to a local address where there is also + a remote which uses callout/hold. Previously the local was queued. + +JH/33 Fix a taint trap in the ${listextract } expansion when the source data + was tainted. + +JH/35 Bug 2343: Harden exim_tidydb against corrupt wait- files. + +JH/36 Bug 2687: Fix interpretation of multiple ^ chars in a plaintext + authenticator client_send option. Previously the next char, after a pair + was collapsed, was taken verbatim (so ^^^foo became ^^foo; ^^^^foo became + ^^\x00foo). Fixed to get ^\x00foo and ^^foo respectively to match the + documentation. There is still no way to get a leading ^ immediately + after a NUL (ie. for the password of a PLAIN method authenticator. + +JH/39 Bug 2691: fix $local_part_data. When the matching list element + referred to a file, bad data was returned. This likely also affected + $domain_part_data. + +JH/41 Fix daemon SIGHUP on FreeBSD. Previously, a named socket for IPC was + left undeleted; the attempt to re-create it then failed - resulting in + the usual "SIGHUP tp have daemon reload configuration" to not work. + This affected any platform not supporting "abstract" Unix-domain + sockets (i.e. not Linux). + +JH/42 Bug 2692: Harden against a peer which reneges on a 452 "too many + recipients" response to RCPT in a later response, with a 250. The + previous coding assumed this would not happen, and under PIPELINING + would result in both lost and duplicate recipients for a message. + +JH/43 Bug 2694: Fix weighted distribution of work to multiple spamd servers. + Previously the weighting was incorrectly applied. Similar fix for socks + proxies. Found and fixed by Heiko Schlichting. + +JH/44 Bug 2701: Fix list-expansion of dns_ipv4_lookup. Previously, it did + not handle sub-lists included using the +namedlist syntax. While + investigating, the same found for dns_trust_aa, dns_again_means_nonexist, + dnssec_require_domains, dnssec_request_domains, srv_fail_domains, + mx_fail_domains. + +HS/01 Enforce absolute PID file path name. + +HS/02 Handle SIGINT as we handle SIGTERM: terminate the Exim process. + +PP/01 Add a too-many-bad-recipients guard to the default config's RCPT ACL. + +PP/02 Bug 2643: Correct TLS DH constants. + A missing NUL termination in our code-generation tool had led to some + incorrect Diffie-Hellman constants in the Exim source. + Reported by kylon94, code-gen tool fix by Simon Arlott. + +PP/03 Impose security length checks on various command-line options. + Fixes CVE-2020-SPRSS reported by Qualys. + +PP/04 Fix Linux security issue CVE-2020-SLCWD and guard against PATH_MAX + better. Reported by Qualys. + +PP/05 Fix security issue CVE-2020-PFPSN and guard against cmdline invoker + providing a particularly obnoxious sender full name. + Reported by Qualys. + +PP/06 Fix CVE-2020-28016 (PFPZA): Heap out-of-bounds write in parse_fix_phrase() + +PP/07 Refuse to allocate too little memory, block negative/zero allocations. + Security guard. + +PP/08 Change default for recipients_max from unlimited to 50,000. + +PP/09 Fix security issue with too many recipients on a message (to remove a + known security problem if someone does set recipients_max to unlimited, + or if local additions add to the recipient list). + Fixes CVE-2020-RCPTL reported by Qualys. + +PP/10 Fix security issue in SMTP verb option parsing + Fixes CVE-2020-EXOPT reported by Qualys. + +PP/11 Fix security issue in BDAT state confusion. + Ensure we reset known-good where we know we need to not be reading BDAT + data, as a general case fix, and move the places where we switch to BDAT + mode until after various protocol state checks. + Fixes CVE-2020-BDATA reported by Qualys. + +HS/03 Die on "/../" in msglog file names + + Exim version 4.94 ----------------- @@ -93,6 +298,7 @@ JH/20 Taint checking: disallow use of tainted data for - the autoreply transport file, log and once options - file names used by the redirect router (including filter files) - named-queue names + - paths used by single-key lookups Previously this was permitted. JH/21 Bug 2501: Fix init call in the heimdal authenticator. Previously it @@ -156,6 +362,56 @@ JH/33 Fix the dsearch lookup to return an untainted result. Previously the taint of the lookup key was maintained; we now regard the presence in the filesystem as sufficient validation. +JH/34 Fix the readsocket expansion to not segfault when an empty "options" + argument is supplied. + +JH/35 The dsearch lookup now requires that the directory is an absolute path. + Previously this was not checked, and nonempty relative paths made an + access under Exim's current working directory. + +JH/36 Bug 2554: Fix msg:defer event for the hosts_max_try_hardlimit case. + Previously no event was raised. + +JH/37 Bug 2552: Fix the check on spool space during reception to use the SIZE + parameter supplied by the sender MAIL FROM command. Previously it was + ignored, and only the check_spool_space option value for the required + leeway checked. + +JH/38 Fix $dkim_key_length. This should, after a DKIM verification, present + the size of the signing public-key. Previously it was instead giving + the size of the signature hash. + +JH/39 DKIM verification: the RFC 8301 restriction on sizes of RSA keys is now + the default. See the (new) dkim_verify_min_keysizes option. + +JH/40 Fix a memory-handling bug: when a connection carried multiple messages + and an ACL use a lookup for checking either the local_part or domain, + stale data could be accessed. Ensure that variable references are + dropped between messages. + +JH/41 Bug 2571: Fix SPA authenticator. Running as a server, an offset supplied + by the client was not checked as pointing within response data before + being used. A malicious client could thus cause an out-of-bounds read and + possibly gain authentication. Fix by adding the check. + +JH/42 Internationalisation: change the default for downconversion in the smtp + transport to be "if needed". Previously it was "as previously set" for + the message, which usually meant "if needed" for message-submission but + "no" for everything else. However, MTAs have been seen using SMTPUTF8 + even when the envelope addresses did not need it, resulting in forwarding + failures to non-supporting MTAs. A downconvert in such cases will be + a no-op on the addresses, merely dropping the use of SMTPUTF8 by the + transport. The change does mean that addresses needing conversion will + be converted when previously a delivery failure would occur. + +JH/43 Fix possible long line in DSN. Previously when a very long SMTP error + response was received it would be used unchecked in a fail-DSN, violating + standards on line-length limits. Truncate if needed. + +HS/01 Remove parameters of the link to www.open-spf.org. The linked form + doesn't work. (Additionally add a new main config option to configure the + spf_smtp_comment) + Exim version 4.93 ----------------- @@ -256,7 +512,7 @@ JH/20 Bug 2389: fix server advertising of usable certificates, under GnuTLS in JH/21 The smtp transport option "hosts_noproxy_tls" is now unset by default. A single TCP connection by a client will now hold a TLS connection open - for multiple message deliveries, by default. Previoud the default was to + for multiple message deliveries, by default. Previously the default was to not do so. JH/22 The smtp transport option "hosts_try_dane" now enables all hosts by @@ -6573,7 +6829,7 @@ Exim version 4.31 same list, then the first domain was re-checked, the value of $domain_data after the final check could be wrong. In particular, if the second check failed, it could be set empty. This bug probably also applied to - $localpart_data. + $local_part_data. 41. The strip_trailing_dot option was not being applied to the address given with the -f command-line option.