X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/9b810c775c6e9dd1f8a87a743b943b465a1ca5a1..9643095d7cae6866b716d361a45c9a95f605040c:/doc/doc-txt/ChangeLog?ds=inline

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index b1b79c240..9d23e8db2 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -2,6 +2,37 @@ This document describes *changes* to previous versions, that might
 affect Exim's operation, with an unchanged configuration file.  For new
 options, and new features, see the NewStuff file next to this ChangeLog.
 
+Exim version 4.98
+-----------------
+
+JH/01 Support list of dkim results in the dkim_status ACL condition, making
+      it more usable in the data ACL.
+
+JH/02 Bug 3040: Handle error on close of the spool data file during reception. 
+      Previously This was only logged, on the assumption that errors would be
+      seen for a previous fflush().  However, a fuse filesystem has been
+      reported as showing this an error for the fclose().  The spool is now in
+      an uncertain state, and we have logged and responded acceptance.  Change
+      this to respond with a temp-reject, wipe spoolfiles, and log the error
+      detail.
+
+JH/03 Bug 3030: Fix handling of DNS servfail respons for DANE TLSA.  When hit
+      during a recipient verify callout, a QUIT command was attempted on the
+      now-closed callout channel, causing a paniclog entry.
+
+JH/04 Bug 3039: Fix handling of of an empty log_reject_target, with
+      a connection_reject log_selector, under tls_on_connect.  Previously
+      with this combination, when the connect ACL rejected, a spurious
+      paniclog entry was made.
+JH/04 Fix TLS resumption for TLS-on-connect.  This was broken by the advent
+      of loadbalancer-detection for resumption, in 4.96 - which tries to
+      use the EHLO response. SMTPS does not have one at the time it is starting
+      TLS.  Change the default for the smtp transport host_name_extract option
+      to be a static string, for TLS-on-connect cases; meaning that resumption
+      will always be attempted (unless deliberately overriden).
+
+
+
 Exim version 4.97
 -----------------
 
@@ -88,7 +119,7 @@ JH/18 Fix a fencepost error in logging.  Previously (since 4.92) when a log line
 
 JH/19 Bug 2911: Fix a recursion in DNS lookups.  Previously, if the main option
       dns_again_means_nonexist included an element causing a DNS lookup which
-      iteslf returned DNS_AGAIN, unbounded recursion occurred.  Possible results
+      itself returned DNS_AGAIN, unbounded recursion occurred.  Possible results
       included (though probably not limited to) a process crash from stack
       memory limit, or from excessive open files.  Replace this with a paniclog
       whine (as this is likely a configuration error), and returning
@@ -190,6 +221,30 @@ JH/38 Taint-track intermediate values from the peer in multi-stage authentation
       this resulted in behaviour of LOGIN vs. PLAIN being inconsistent under
       bad coding of authenticators.
 
+JH/39 Bug 3023: Fix crash induced by some combinations of zero-length strings
+      and ${tr...}.  Found and diagnosed by Heiko Schlichting.
+
+JH/40 Bug 2999: Fix a possible OOB write in the external authenticator, which
+      could be triggered by externally-supplied input.  Found by Trend Micro.
+      CVE-2023-42115
+
+JH/41 Bug 3000: Fix a possible OOB write in the SPA authenticator, which could
+      be triggered by externally-controlled input.  Found by Trend Micro.
+      CVE-2023-42116
+
+JH/42 Bug 3001: Fix a possible OOB read in the SPA authenticator, which could
+      be triggered by externally-controlled input.  Found by Trend Micro.
+      CVE-2023-42114
+
+JH/43 Bug 2903: avoid exit on an attempt to rewrite a malformed address.
+      Make the rewrite never match and keep the logging.  Trust the
+      admin to be using verify=header-syntax (to actually reject the message).
+
+JH/44 Bug 3033: Harden dnsdb lookups against crafted DNS responses.
+      CVE-2023-42219
+
+HS/02 Fix string_is_ip_address() CVE-2023-42117 (Bug 3031)
+
 
 Exim version 4.96
 -----------------