CVE-2020-28018 - log back

CVE-2020-28018 edited at 06 May 2021 17:20:41
Description
- A use-after-free in tls-openssl.c has been found in Exim from version 4.90 and before version 4.94.2, allowing for unauthenticated remote code execution as the "exim" user if TLS encryption is provided by OpenSSL.
+ Exim 4 before 4.94.2 allows use after free in smtp_reset in certain situations that may be common for builds with OpenSSL.
CVE-2020-28018 edited at 04 May 2021 14:38:37
Description
- A use-after-free in tls-openssl.c has been found in Exim before version 4.94.2.
+ A use-after-free in tls-openssl.c has been found in Exim from version 4.90 and before version 4.94.2, allowing for unauthenticated remote code execution as the "exim" user if TLS encryption is provided by OpenSSL.
References
https://www.openwall.com/lists/oss-security/2021/05/04/6
https://www.qualys.com/2021/05/04/21nails/21nails.txt
+ https://git.exim.org/exim.git/commitdiff/a53a7fcfb8216764e4420d8d263356b4ed7d5cef
Notes
CVE-2020-28018 edited at 04 May 2021 14:01:59
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Remote
Type
- Unknown
+ Arbitrary code execution
Description
+ A use-after-free in tls-openssl.c has been found in Exim before version 4.94.2.
References
+ https://www.openwall.com/lists/oss-security/2021/05/04/6
+ https://www.qualys.com/2021/05/04/21nails/21nails.txt
CVE-2020-28018 created at 04 May 2021 13:46:53