ASA-201908-4 log original external raw

Arch Linux Security Advisory ASA-201908-4 ========================================= Severity: Critical Date : 2019-08-05 CVE-ID : CVE-2019-13917 Package : exim Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1011 Summary ======= The package exim before version 4.92.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.92.1-1. # pacman -Syu "exim>=4.92.1-1" The problem has been fixed upstream in version 4.92.1. Workaround ========== None. Description =========== Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $local_part or $domain). Impact ====== A remote attacker can, in some unusual configurations, execute arbitrary code via a crafted e-mail. References ========== https://seclists.org/oss-sec/2019/q3/63 https://lists.exim.org/lurker/message/20190725.090419.d506f736.en.html https://security.archlinux.org/CVE-2019-13917