From c1fb74d63ecf0cd1501e53352419bfdfd154b7ea Mon Sep 17 00:00:00 2001 From: Phil Pennock Date: Thu, 29 Oct 2020 18:11:35 -0400 Subject: SECURITY: length limits on many cmdline options We'll also now abort upon, rather than silently truncate, a driver name (router, transport, ACL, etc) encountered in the config which is longer than the 64-char limit. (cherry picked from commit ff8bef9ae2370db4a7873fe2ce573a607fe6999f) (cherry picked from commit a8bd24b96c2027fd839f95a9e6b3282453ae288e) --- doc/doc-txt/ChangeLog | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'doc/doc-txt/ChangeLog') diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index 58ba70f02..4c6eb810e 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -263,6 +263,12 @@ PP/02 Bug 2643: Correct TLS DH constants. incorrect Diffie-Hellman constants in the Exim source. Reported by kylon94, code-gen tool fix by Simon Arlott. +PP/03 Fix Linux security issue CVE-2020-SLCWD and guard against PATH_MAX + better. Reported by Qualys. + +PP/04 Impose security length checks on various command-line options. + Fixes CVE-2020-SPRSS reported by Qualys. + Exim version 4.94 ----------------- -- cgit v1.2.3