USN-6881-1: Exim vulnerability
It was discovered that Exim did not enforce STARTTLS sync point on client side. An attacker could possibly use this issue to perform response injection during MTA SMTP sending.
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-6881-1?
The severity of USN-6881-1 is considered medium due to the potential for response injection during MTA SMTP sending.
How do I fix USN-6881-1?
To fix USN-6881-1, upgrade Exim to version 4.93-13ubuntu1.11 or later for Ubuntu 20.04, or apply the specific upgrades for other affected versions.
What is the impact of USN-6881-1?
The impact of USN-6881-1 allows attackers to perform response injection due to the lack of STARTTLS sync point enforcement.
Which systems are affected by USN-6881-1?
USN-6881-1 affects multiple versions of Exim on Ubuntu systems including versions 20.04, 18.04, 16.04, and 14.04.
Is there a workaround for USN-6881-1?
As of now, there is no official temporary workaround for USN-6881-1 other than upgrading to the patched version.