Debian Bug report logs - #992172
exim4: CVE-2021-38371

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: exim4: CVE-2021-38371

Date: Sat, 14 Aug 2021 22:47:00 +0200

Source: exim4
Version: 4.94.2-7
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for exim4, this is to start
tracking the issue downstream for us. Note that at time of writing [2]
gives still a 404.

CVE-2021-38371[0]:
| The STARTTLS feature in Exim through 4.94.2 allows response injection
| (buffering) during MTA SMTP sending.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-38371
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38371
[1] https://nostarttls.secvuln.info
[2] https://www.exim.org/static/doc/security/CVE-2021-38371.txt

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 992172@bugs.debian.org (full text, mbox, reply):

From: Andreas Metzler <ametzler@bebt.de>

To: Salvatore Bonaccorso <carnil@debian.org>, 992172@bugs.debian.org

Subject: Re: Bug#992172: exim4: CVE-2021-38371

Date: Sun, 15 Aug 2021 07:21:40 +0200

On 2021-08-14 Salvatore Bonaccorso <carnil@debian.org> wrote:
> Source: exim4
> Version: 4.94.2-7
> Severity: important
> Tags: security upstream
> X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

> Hi,

> The following vulnerability was published for exim4, this is to start
> tracking the issue downstream for us. Note that at time of writing [2]
> gives still a 404.

> CVE-2021-38371[0]:
> | The STARTTLS feature in Exim through 4.94.2 allows response injection
> | (buffering) during MTA SMTP sending.
[...]

IIRC that is mitigated in experimental (4.95 rc) by ALPN and unkown
command related changes, I will not be able to check in detail for a
week or so, though.

cu Andreas

Message #15 received at 992172@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Andreas Metzler <ametzler@bebt.de>

Cc: 992172@bugs.debian.org

Subject: Re: Bug#992172: exim4: CVE-2021-38371

Date: Sun, 15 Aug 2021 09:04:46 +0200

HI Andreas,

On Sun, Aug 15, 2021 at 07:21:40AM +0200, Andreas Metzler wrote:
> On 2021-08-14 Salvatore Bonaccorso <carnil@debian.org> wrote:
> > Source: exim4
> > Version: 4.94.2-7
> > Severity: important
> > Tags: security upstream
> > X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
> 
> > Hi,
> 
> > The following vulnerability was published for exim4, this is to start
> > tracking the issue downstream for us. Note that at time of writing [2]
> > gives still a 404.
> 
> > CVE-2021-38371[0]:
> > | The STARTTLS feature in Exim through 4.94.2 allows response injection
> > | (buffering) during MTA SMTP sending.
> [...]
> 
> IIRC that is mitigated in experimental (4.95 rc) by ALPN and unkown
> command related changes, I will not be able to check in detail for a
> week or so, though.

Ack thanks for the information. Let's wait to see what's written in de
advisory URL once it becomes public.

Thanks for your work on exim4 packages!

Regards,
Salvatore

Message #20 received at 992172@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Andreas Metzler <ametzler@bebt.de>

Cc: Salvatore Bonaccorso <carnil@debian.org>, 992172@bugs.debian.org

Subject: Re: Bug#992172: exim4: CVE-2021-38371

Date: Wed, 15 Mar 2023 17:18:15 +0100

Am Sun, Aug 15, 2021 at 07:21:40AM +0200 schrieb Andreas Metzler:
> On 2021-08-14 Salvatore Bonaccorso <carnil@debian.org> wrote:
> > Source: exim4
> > Version: 4.94.2-7
> > Severity: important
> > Tags: security upstream
> > X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
> 
> > Hi,
> 
> > The following vulnerability was published for exim4, this is to start
> > tracking the issue downstream for us. Note that at time of writing [2]
> > gives still a 404.
> 
> > CVE-2021-38371[0]:
> > | The STARTTLS feature in Exim through 4.94.2 allows response injection
> > | (buffering) during MTA SMTP sending.
> [...]
> 
> IIRC that is mitigated in experimental (4.95 rc) by ALPN and unkown
> command related changes, I will not be able to check in detail for a
> week or so, though.

Do you know if this is fixed in 4.96/bookworm?

Cheers,
        Moritz

Message #25 received at 992172@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Moritz Mühlenhoff <jmm@inutil.org>

Cc: Andreas Metzler <ametzler@bebt.de>, 992172@bugs.debian.org, hs@schlittermann.de

Subject: Re: Bug#992172: exim4: CVE-2021-38371

Date: Wed, 15 Mar 2023 20:49:01 +0100

Hello Andreas and Moritz,

On Wed, Mar 15, 2023 at 05:18:15PM +0100, Moritz Mühlenhoff wrote:
> Am Sun, Aug 15, 2021 at 07:21:40AM +0200 schrieb Andreas Metzler:
> > On 2021-08-14 Salvatore Bonaccorso <carnil@debian.org> wrote:
> > > Source: exim4
> > > Version: 4.94.2-7
> > > Severity: important
> > > Tags: security upstream
> > > X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
> > 
> > > Hi,
> > 
> > > The following vulnerability was published for exim4, this is to start
> > > tracking the issue downstream for us. Note that at time of writing [2]
> > > gives still a 404.
> > 
> > > CVE-2021-38371[0]:
> > > | The STARTTLS feature in Exim through 4.94.2 allows response injection
> > > | (buffering) during MTA SMTP sending.
> > [...]
> > 
> > IIRC that is mitigated in experimental (4.95 rc) by ALPN and unkown
> > command related changes, I will not be able to check in detail for a
> > week or so, though.
> 
> Do you know if this is fixed in 4.96/bookworm?

Looks the planned advisory at
https://www.exim.org/static/doc/security/CVE-2021-38371.txt is not
online.

Looping in as well Heiko Schlittermann. Heiko, can you share details
on fixes?

Regards,
Salvatore

Message #30 received at 992172@bugs.debian.org (full text, mbox, reply):

From: Heiko Schlittermann <hs@schlittermann.de>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: Moritz Mühlenhoff <jmm@inutil.org>, Andreas Metzler <ametzler@bebt.de>, 992172@bugs.debian.org

Subject: Re: Bug#992172: exim4: CVE-2021-38371

Date: Wed, 15 Mar 2023 23:32:58 +0100

[Message part 1 (text/plain, inline)]

[not encrypted, I'm not able to find the key of Moritz]
Hi,

Salvatore Bonaccorso <carnil@debian.org> (Mi 15 Mär 2023 20:49:01 CET):
> Looks the planned advisory at
> https://www.exim.org/static/doc/security/CVE-2021-38371.txt is not
> online.

I found the message from last year on the list, and the today's messages
too. It seems that there was some discussion about the content of the
advisory.

I'll try to clarify it and then return.

-- 
Heiko

[signature.asc (application/pgp-signature, inline)]

Message #35 received at 992172-done@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Andreas Metzler <ametzler@bebt.de>

Cc: Moritz Mühlenhoff <jmm@inutil.org>, 992172-done@bugs.debian.org

Subject: Re: Bug#992172: exim4: CVE-2021-38371

Date: Thu, 16 Mar 2023 20:50:50 +0100

Source: exim4
Source-Version: 4.95~RC0-1

On Thu, Mar 16, 2023 at 06:21:47PM +0100, Andreas Metzler wrote:
> On 2023-03-15 Moritz Mühlenhoff <jmm@inutil.org> wrote:
> > Am Sun, Aug 15, 2021 at 07:21:40AM +0200 schrieb Andreas Metzler:
> > > On 2021-08-14 Salvatore Bonaccorso <carnil@debian.org> wrote:
> [...]
> > > > CVE-2021-38371[0]:
> > > > | The STARTTLS feature in Exim through 4.94.2 allows response injection
> > > > | (buffering) during MTA SMTP sending.
> > > [...]
> > > 
> > > IIRC that is mitigated in experimental (4.95 rc) by ALPN and unkown
> > > command related changes, I will not be able to check in detail for a
> > > week or so, though.
> 
> > Do you know if this is fixed in 4.96/bookworm?
> 
> Yes it is. 4.95 and later are fine.
> https://lists.exim.org/lurker/message/20230315.200011.3128be8e.en.html

Thanks, so the mentioned commit was in exim-4.95-RC0 upstream tag, and
so fixed in Debian first with the eximerimental upload 4.95~RC0-1.

Commited locally for the security-tracker and closing the bug (but
various Debian services are down right now).

Regards,
Salvatore

Message #40 received at 992172@bugs.debian.org (full text, mbox, reply):

From: Andreas Metzler <ametzler@bebt.de>

To: Moritz Mühlenhoff <jmm@inutil.org>

Cc: Salvatore Bonaccorso <carnil@debian.org>, 992172@bugs.debian.org

Subject: Re: Bug#992172: exim4: CVE-2021-38371

Date: Thu, 16 Mar 2023 18:21:47 +0100

On 2023-03-15 Moritz Mühlenhoff <jmm@inutil.org> wrote:
> Am Sun, Aug 15, 2021 at 07:21:40AM +0200 schrieb Andreas Metzler:
> > On 2021-08-14 Salvatore Bonaccorso <carnil@debian.org> wrote:
[...]
> > > CVE-2021-38371[0]:
> > > | The STARTTLS feature in Exim through 4.94.2 allows response injection
> > > | (buffering) during MTA SMTP sending.
> > [...]
> > 
> > IIRC that is mitigated in experimental (4.95 rc) by ALPN and unkown
> > command related changes, I will not be able to check in detail for a
> > week or so, though.

> Do you know if this is fixed in 4.96/bookworm?

Yes it is. 4.95 and later are fine.
https://lists.exim.org/lurker/message/20230315.200011.3128be8e.en.html

cu Andreas

-- 
`What a good friend you are to him, Dr. Maturin. His other friends are
so grateful to you.'
`I sew his ears on from time to time, sure'

Message #45 received at 992172-done@bugs.debian.org (full text, mbox, reply):

From: Andreas Metzler <ametzler@bebt.de>

To: 992172-done@bugs.debian.org

Subject: Re: Bug#992172: exim4: CVE-2021-38371

Date: Thu, 16 Mar 2023 18:39:35 +0100

Version: 4.95~RC2-1

On 2021-08-15 Andreas Metzler <ametzler@bebt.de> wrote:
> On 2021-08-14 Salvatore Bonaccorso <carnil@debian.org> wrote:
> > Source: exim4
> > Version: 4.94.2-7
[...]
> > The following vulnerability was published for exim4, this is to start
> > tracking the issue downstream for us. Note that at time of writing [2]
> > gives still a 404.

> > CVE-2021-38371[0]:
> > | The STARTTLS feature in Exim through 4.94.2 allows response injection
> > | (buffering) during MTA SMTP sending.
> [...]

> IIRC that is mitigated in experimental (4.95 rc) by ALPN and unkown
> command related changes, I will not be able to check in detail for a
> week or so, though.

Fixed with commit 1b9ab35f323121aabf029f0496c7227818efad14.

https://lists.exim.org/lurker/message/20230315.200011.3128be8e.en.html

cu Andreas
-- 
`What a good friend you are to him, Dr. Maturin. His other friends are
so grateful to you.'
`I sew his ears on from time to time, sure'

Send a report that this bug log contains spam.