Don't open spool data-files which are symlinks

[users/jgh/exim.git] / doc / doc-txt / ChangeLog

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 1b36204459ea0ddbe6963d15f6d63b75cc756088..d99b2684ac79186ce49d508c95496bd96fc729e6 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -25,10 +25,13 @@ JH/04 Add variables $arc_domains, $arc_oldest_pass for ARC verify.  Fix the
 JH/05 Bug 2273: Cutthrough delivery left a window where the received messsage
       files in the spool were present and unlocked.  A queue-runner could spot
       them, resulting in a duplicate delivery.  Fix that by doing the unlock
-      after the unlink.  Investigation by Time Stewart.  Take the opportunity to
-      add more error-checking on spoofile handling while that code is being
+      after the unlink.  Investigation by Tim Stewart.  Take the opportunity to
+      add more error-checking on spoolfile handling while that code is being
       messed with.
 
+PP/01 Refuse to open a spool data file (*-D) if it's a symlink.
+      No known attacks, no CVE, this is defensive hardening.
+
 
 Exim version 4.91
 -----------------