CVE-2020-28026

Upstream information

CVE-2020-28026 at MITRE

Description

Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary commands as root.

---

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having important severity.

SUSE Bugzilla entry: 1185631 [RESOLVED / FIXED]

SUSE Security Advisories:

• openSUSE-SU-2021:0677-1, published Fri May 7 15:38:31 2021
• openSUSE-SU-2021:0753-1, published Thu May 20 15:39:10 2021
• openSUSE-SU-2021:0754-1, published Thu May 20 15:39:10 2021

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Package Hub 15 SP1	exim >= 4.94.2-bp151.2.4.1 eximon >= 4.94.2-bp151.2.4.1 eximstats-html >= 4.94.2-bp151.2.4.1 libspf2-2 >= 1.2.10-bp151.4.1 libspf2-devel >= 1.2.10-bp151.4.1 libspf2-tools >= 1.2.10-bp151.4.1	Patchnames: openSUSE-2021-753
SUSE Package Hub 15 SP2	exim >= 4.94.2-bp152.6.4.1 eximon >= 4.94.2-bp152.6.4.1 eximstats-html >= 4.94.2-bp152.6.4.1 libspf2-2 >= 1.2.10-bp152.5.1 libspf2-devel >= 1.2.10-bp152.5.1 libspf2-tools >= 1.2.10-bp152.5.1	Patchnames: openSUSE-2021-754
openSUSE Leap 15.2	exim >= 4.94.2-lp152.8.3.1 eximon >= 4.94.2-lp152.8.3.1 eximstats-html >= 4.94.2-lp152.8.3.1	Patchnames: openSUSE-2021-677
openSUSE Tumbleweed	exim >= 4.94.2-4.2 eximon >= 4.94.2-4.2 eximstats-html >= 4.94.2-4.2	Patchnames: openSUSE Tumbleweed GA exim-4.94.2-4.2