CVE-2020-28026: Critical severity Exim Exim vulnerability
Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary commands as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/eximto a version that resolves this vulnerability.Fixed in 4.94.2-r0 - Upgrade
Upgrade
Eximto a version that resolves this vulnerability.Fixed in 4.94.2
Event History
Frequently Asked Questions
What is the vulnerability ID for this Exim vulnerability?
The vulnerability ID for this Exim vulnerability is CVE-2020-28026.
What is the severity of CVE-2020-28026?
The severity of CVE-2020-28026 is critical.
Which versions of Exim are affected by CVE-2020-28026?
Exim versions from 4.00 to 4.94.2 are affected by CVE-2020-28026.
What is the impact of CVE-2020-28026?
CVE-2020-28026 can allow unauthenticated remote attackers to execute arbitrary code.
Is there a fix available for CVE-2020-28026?
Yes, the fix for CVE-2020-28026 is included in Exim version 4.94.2.