Avoid exposing passwords in log, on failing ldap lookup expansion. Bug 165

[users/heiko/exim.git] / doc / doc-txt / ChangeLog

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 496e9d07e245702571453dd2665ad670e3b599fe..4171d61c4c70f119120d5e433fc05318ce98aa7f 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -10,6 +10,25 @@ JH/02 The obsolete acl condition "demime" is removed (finally, after ten
       years of being deprecated). The replacements are the ACLs
       acl_smtp_mime and acl_not_smtp_mime.
 
       years of being deprecated). The replacements are the ACLs
       acl_smtp_mime and acl_not_smtp_mime.
 

+JH/03 Upgrade security requirements imposed for hosts_try_dane: previously
+      a downgraded non-dane trust-anchor for the TLS connection (CA-style)
+      or even an in-clear connection were permitted.  Now, if the host lookup
+      was dnssec and dane was requested then the host is only used if the
+      TLSA lookup succeeds and is dnssec.  Further hosts (eg. lower priority
+      MXs) will be tried (for hosts_try_dane though not for hosts_require_dane)
+      if one fails this test.
+      This means that a poorly-configured remote DNS will make it incommunicado;
+      but it protects against a DNS-interception attack on it.
+
+JH/04 Bug 1810: make continued-use of an open smtp transport connection
+      non-noisy when a race steals the message being considered.
+
+JH/05 If main configuration option tls_certificate is unset, generate a
+      selfsigned certificate for inbound TLS connections.
+
+JH/06 Bug 165: hide more cases of password exposure - this time in expansions
+      in rewrites.
+

 
 Exim version 4.87
 -----------------
 
 Exim version 4.87
 -----------------