Re: CVE-2019-10149

--===============0749788289==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="ud6z54mzeh4cexyv"
Content-Disposition: inline


--ud6z54mzeh4cexyv
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

The fix for CVE-2019-10149 is public now.

    https://git.exim.org/exim.git
    Branch exim-4_91+fixes.

Thank you to
    - Qualys for reporting it.
    - Jeremy for fixing it.
    - you for using Exim.

Sorry for confusion about the public release. We were forced to react,
as details leaked.

The patch should apply cleanly to all affected versions (4.87->4.91). We
do not do a security release, as the official Exim version is at 4.92
already and older releases are considered to be outdated and not
supported by the developers anymore.

Please do not hesitate to contact us if you need help backporting the
fix.

Details of the commit:

    |commit d740d2111f189760593a303124ff6b9b1f83453d
    |gpg: Signature made Di 04 Jun 2019 11:27:33 CEST
    |gpg:                using RSA key D0BFD6B9ECA5694A6F149DCEAF4CC676A6B6=
C142
    |gpg:                issuer "[email protected]"
    |gpg: Good signature from "Heiko Schlittermann (Dresden) <hs@schlitterm=
ann.de>" [full]
    |gpg:                 aka "Heiko Schlittermann (HS12-RIPE) <hs@schlitte=
rmann.de>" [full]
    |gpg:                 aka "[jpeg image of size 4759]" [full]
    |gpg:                 aka "Heiko Schlittermann (Exim MTA Maintainer) <h=
[email protected]>" [full]
    |gpg:                 aka "Heiko Schlittermann (HS12-RIPE) <hs@nodmarc.=
schlittermann.de>" [undefined]
    |Author: Jeremy Harris <[email protected]>
    |Date:   Mon May 27 21:57:31 2019 +0100
    |
    |   Fix CVE-2019-10149


    Best regards from Dresden/Germany
    Viele Gr=C3=BC=C3=9Fe aus Dresden
    Heiko Schlittermann
--
 SCHLITTERMANN.de ---------------------------- internet & unix support -
 Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
 gnupg encrypted messages are welcome --------------- key ID: F69376CE -
 ! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -

--ud6z54mzeh4cexyv
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEE0L/WueylaUpvFJ3Or0zGdqa2wUIFAlz33V0ACgkQr0zGdqa2
wUL71Qf/SDtpvo41s9O4J9hHqXmfAGHGXYqf9dcL5jKk9UKYkdPsJvvZKSd9YAgp
u5sP3XWeHUVBykKqd+edN7F7vhvR4Y6WI4twL9Mhw2n7VIvKuP2Ab3F8VlVj07Tw
XjK2bBXbvCwt0LRuUgLtc9CTd3aNjqEs6aW67YILQFfdxZu1bh1Lfdad9WZ1YMvg
kKVdR36EyQk70CfBK8Cluaqwu2ZWJThOsdVaabfFYuA4yAgoK+2Oe5woF4mDcRVo
MqfEkmhvWGsfOwDMkeWDoUthwF+jfCJ/N57M84U9+OkUd1OzBuGzojrOy1nbvHtA
Vv36BpMZYzMGJ9rJNgV+LYL6YrO1ow==
=GRl1
-----END PGP SIGNATURE-----

--ud6z54mzeh4cexyv--


--===============0749788289==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-announce Exim details at http://www.exim.org/ ##

--===============0749788289==--