Doc: more detail for CVE-2016-9963

diff --git a/doc/doc-txt/cve-2016-9663 b/doc/doc-txt/cve-2016-9663
index ae85a73cbc5a137c617394a30a68bb019a56488f..8a9a2cad226c764334cfbceb98fcfdad5f55a8b3 100644 (file)
--- a/doc/doc-txt/cve-2016-9663
+++ b/doc/doc-txt/cve-2016-9663
@@ -55,6 +55,14 @@ Exim leaks the private DKIM signing key to the log files.  Additionally,
 if the build option EXPERIMENTAL_DSN_INFO=yes is used, the key material
 is included in the bounce message.
 
+Even if there is no evidence in the existing log files, that a DKIM key
+leakage happened this might have happened in the past, log files might
+have been deleted already but a key leak could have ended up via mail
+bounce in a user mail box
+
+Depending on your system configuration the leakage might have happened
+even without traces in the logs
+
 Fix
 ===
 
@@ -69,6 +77,11 @@ depending on our resources we will support you in backporting the fix.
 (Please note, that Exim project officially doesn't support versions
 prior the current stable version.)
 
+If you think that you MIGHT be affected, we HIGHLY recommend to create
+a new set of DKIM keys and fade out the previous DKIM key soon to make
+sure that a possibly leaked DKIM key can not be misused in the future.
+
+
 Workaround
 ==========