Add security postings for future reference

[users/heiko/exim.git] / doc / doc-txt / cve-2019-13917 / posting-2019-07-18.txt

diff --git a/doc/doc-txt/cve-2019-13917/posting-2019-07-18.txt b/doc/doc-txt/cve-2019-13917/posting-2019-07-18.txt
new file mode 100644 (file)
index 0000000..56ca10f
--- /dev/null
+++ b/doc/doc-txt/cve-2019-13917/posting-2019-07-18.txt
@@ -0,0 +1,72 @@
+To: distros@vs.openwall.org, exim-maintainers@exim.org
+From: [ do not use a dmarc protected sender ]
+
+** EMBARGO *** This information is not public yet.
+
+CVE ID:     CVE-2019-13917
+OVE ID:     OVE-20190718-0006
+Date:       2019-07-18
+Credits:    Jeremy Harris
+Version(s): 4.85 up to and including 4.92
+Issue:      A local or remote attacker can execute programs with root
+            privileges - if you've an unusual configuration. For details
+           see below.
+
+Contact:    exim-security@exim.org
+
+Proposed Timeline
+=================
+
+t0: NOW
+    - this notice to distros@vs.openwall.org and exim-maintainers@exim.org
+    - open limited access to our security Git repo. See below.
+
+t0+~4d: Mon Jul 22 10:00:00 UTC 2019
+    - head-up notice to oss-security@lists.openwall.com,
+      exim-users@exim.org, and exim-announce@exim.org
+
+t0+~7d: Thu Jul 25 10:00:00 UTC 2019
+    - Coordinated relase date
+    - publish the patches in our official and public Git repositories
+      and the packages on our FTP server.
+
+Downloads
+=========
+
+For release tarballs (exim-4.92.1):
+
+    git clone --depth 1 ssh://git@exim.org/exim-packages
+
+The package files are signed with my GPG key.
+
+For the full Git repo:
+
+    git clone ssh://git@exim.org/exim
+    - tag    exim-4.92.1
+    - branch exim-4.92+fixes
+
+The tagged commit is the officially released version. The tag is signed
+with my GPG key.  The +fixes branch isn't officially maintained, but
+contains useful patches *and* the security fix. The relevant commit
+is signed with my GPG key.
+
+If you need help backporting the patch, please contact us directly.
+
+Conditions to be vulnerable
+===========================
+
+If your configuration uses the ${sort } expansion for items that can be
+controlled by an attacker (e.g. $local_part, $domain). The default
+config, as shipped by the Exim developers, does not contain ${sort }.
+
+Details
+=======
+
+The vulnerability is exploitable either remotely or locally and could
+be used to execute other programs with root privilege.  The ${sort }
+expansion re-evaluates its items.
+
+Mitigation
+==========
+
+Do not use ${sort } in your configuration.