CVE-2020-12783: High severity Exim Exim vulnerability
Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/exim4to a version that resolves this vulnerability.Fixed in 4.90.1-1ubuntu1.5 - Upgrade
Upgrade
ubuntu/exim4to a version that resolves this vulnerability.Fixed in 4.92.1-1ubuntu3.1 - Upgrade
Upgrade
ubuntu/exim4to a version that resolves this vulnerability.Fixed in 4.93-13ubuntu1.1 - Upgrade
Upgrade
ubuntu/exim4to a version that resolves this vulnerability.Fixed in 4.82-3ubuntu2.4+ - Upgrade
Upgrade
ubuntu/exim4to a version that resolves this vulnerability.Fixed in 4.93-16 - Upgrade
Upgrade
ubuntu/exim4to a version that resolves this vulnerability.Fixed in 4.86.2-2ubuntu2.6 - Upgrade
Upgrade
debian/exim4to a version that resolves this vulnerability.Fixed in 4.94.2-7+deb11u2Fixed in 4.94.2-7+deb11u3Fixed in 4.96-15+deb12u4Fixed in 4.96-15+deb12u5Fixed in 4.98-1 - Upgrade
Upgrade
alpine/eximto a version that resolves this vulnerability.Fixed in 4.93-r1
Event History
Frequently Asked Questions
What is CVE-2020-12783?
CVE-2020-12783 is a vulnerability in Exim version 4.93 and earlier that allows for an out-of-bounds read in the SPA authenticator, potentially leading to authentication bypass.
What is the severity of CVE-2020-12783?
The severity of CVE-2020-12783 is high with a CVSS score of 7.5.
Which software versions are affected by CVE-2020-12783?
Exim versions up to and including 4.93 are affected by CVE-2020-12783.
How can I fix CVE-2020-12783 on Ubuntu?
To fix CVE-2020-12783 on Ubuntu, you can update the 'exim4' package to version 4.93-16 or later.
Where can I find more information about CVE-2020-12783?
You can find more information about CVE-2020-12783 on the MITRE CVE database, Ubuntu security notices, and NVD.