X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/ad93c40fe70f7de49ffb8601a589e9ffa117d512..afdb5e9cf07fa49e26e128d8d5d2e3cab7a5fe42:/doc/doc-txt/ChangeLog diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index 837b38083..bc3f8d393 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -5,6 +5,78 @@ affect Exim's operation, with an unchanged configuration file. For new options, and new features, see the NewStuff file next to this ChangeLog. +Exim version 4.92 +----------------- + +JH/01 Remove code calling the customisable local_scan function, unless a new + definition "HAVE_LOCAL_SCAN=yes" is present in the Local/Makefile. + +JH/02 Bug 1007: Avoid doing logging from signal-handlers, as that can result in + non-signal-safe functions being used. + +JH/03 Bug 2269: When presented with a received message having a stupidly large + number of DKIM-Signature headers, disable DKIM verification to avoid + a resource-consumption attack. The limit is set at twenty. + +JH/04 Add variables $arc_domains, $arc_oldest_pass for ARC verify. Fix the + report of oldest_pass in ${authres } in consequence, and separate out + some descriptions of reasons for verification fail. + +JH/05 Bug 2273: Cutthrough delivery left a window where the received messsage + files in the spool were present and unlocked. A queue-runner could spot + them, resulting in a duplicate delivery. Fix that by doing the unlock + after the unlink. Investigation by Tim Stewart. Take the opportunity to + add more error-checking on spoolfile handling while that code is being + messed with. + +PP/01 Refuse to open a spool data file (*-D) if it's a symlink. + No known attacks, no CVE, this is defensive hardening. + +JH/06 Bug 2275: The MIME ACL unlocked the received message files early, and + a queue-runner could start a delivery while other operations were ongoing. + Cutthrough delivery was a common victim, resulting in duplicate delivery. + Found and investigated by Tim Stewart. Fix by using the open message data + file handle rather than opening another, and not locally closing it (which + releases a lock) for that case, while creating the temporary .eml format + file for the MIME ACL. Also applies to "regex" and "spam" ACL conditions. + +JH/07 Bug 177: Make a random-recipient callout success visible in ACL, by setting + $sender_verify_failure/$recipient_verify_failure to "random". + +JH/08 When generating a selfsigned cert, use serial number 1 since zero is not + legitimate. + +JH/09 Bug 2274: Fix logging of cmdline args when starting in an unlinked cwd. + Previously this would segfault. + +JH/10 Fix ARC signing for case when DKIM signing failed. Previously this would + segfault. + +JH/11 Bug 2264: Exim now only follows CNAME chains one step by default. We'd + like zero, since the resolver should be doing this for us, But we need one + as a CNAME but no MX presence gets the CNAME returned; we need to check + that doesn't point to an MX to declare it "no MX returned" rather than + "error, loop". A new main option is added so the older capability of + following some limited number of chain links is maintained. + +JH/12 Add client-ip info to non-pass iprev ${authres } lines. + +JH/13 For receent Openssl versions (1.1 onward) use modern generic protocol + methods. These should support TLS 1.3; they arrived with TLS 1.3 and the + now-deprecated earlier definitions used only specified the range up to TLS + 1.2 (in the older-version library docs). + +JH/14 Bug 2284: Fix DKIM signing for body lines starting with a pair of dots. + +JH/15 Rework TLS client-side context management. Stop using a global, and + explicitly pass a context around. This enables future use of TLS for + connections to service-daemons (eg. malware scanning) while a client smtp + connection is using TLS; with cutthrough connections this is quite likely. + +JH/16 Fix ARC verification to do AS checks in reverse order. +JH/16 Support a "tls" option on the ${readsocket } expansion item. + + Exim version 4.91 ----------------- @@ -190,11 +262,30 @@ JH/35 Cutthrough: for a final-dot response timeout (and nonunderstood responses) PP/02 DANE: add dane_require_tls_ciphers SMTP Transport option; if unset, tls_require_ciphers is used as before. -HS/03 Malware Avast: Better match the Avast multiline protocol. - Only tmpfails from the scanner are written to the paniclog, as - they may require admin intervention (permission denied, license - issues). Other scanner errors (like decompression bombs) do not - cause a paniclog entry. +HS/03 Malware Avast: Better match the Avast multiline protocol. Add + "pass_unscanned". Only tmpfails from the scanner are written to + the paniclog, as they may require admin intervention (permission + denied, license issues). Other scanner errors (like decompression + bombs) do not cause a paniclog entry. + +JH/36 Fix reinitialisation of DKIM logging variable between messages. + Previously it was possible to log spurious information in receive log + lines. + +JH/37 Bug 2255: Revert the disable of the OpenSSL session caching. This + triggered odd behaviour from Outlook Express clients. + +PP/03 Add util/renew-opendmarc-tlds.sh script for safe renewal of public + suffix list. + +JH/38 DKIM: accept Ed25519 pubkeys in SubjectPublicKeyInfo-wrapped form, + since the IETF WG has not yet settled on that versus the original + "bare" representation. + +JH/39 Fix syslog logging for syslog_timestamp=no and log_selector +millisec. + Previously the millisecond value corrupted the output. + Fix also for syslog_pid=no and log_selector +pid, for which the pid + corrupted the output. Exim version 4.90