Important: exim

2024-01-1901:19:00

alas.aws.amazon.com

smtp smuggling

spf bypass

spoofed mail from

cve-2023-51766

exim

yum update

new packages

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

6.9 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.4%

JSON

Issue Overview:

Exim through 4.97 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not. (CVE-2023-51766)

Affected Packages:

exim

Issue Correction:
Run yum update exim to update your system.

New Packages:

i686:  
    exim-mysql-4.92-1.40.amzn1.i686  
    exim-pgsql-4.92-1.40.amzn1.i686  
    exim-greylist-4.92-1.40.amzn1.i686  
    exim-4.92-1.40.amzn1.i686  
    exim-mon-4.92-1.40.amzn1.i686  
    exim-debuginfo-4.92-1.40.amzn1.i686  
  
src:  
    exim-4.92-1.40.amzn1.src  
  
x86_64:  
    exim-mysql-4.92-1.40.amzn1.x86_64  
    exim-mon-4.92-1.40.amzn1.x86_64  
    exim-pgsql-4.92-1.40.amzn1.x86_64  
    exim-4.92-1.40.amzn1.x86_64  
    exim-debuginfo-4.92-1.40.amzn1.x86_64  
    exim-greylist-4.92-1.40.amzn1.x86_64

Additional References

Red Hat: CVE-2023-51766

Mitre: CVE-2023-51766

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686exim-mysql< 4.92-1.40.amzn1exim-mysql-4.92-1.40.amzn1.i686.rpm
Amazon Linux1i686exim-pgsql< 4.92-1.40.amzn1exim-pgsql-4.92-1.40.amzn1.i686.rpm
Amazon Linux1i686exim-greylist< 4.92-1.40.amzn1exim-greylist-4.92-1.40.amzn1.i686.rpm
Amazon Linux1i686exim< 4.92-1.40.amzn1exim-4.92-1.40.amzn1.i686.rpm
Amazon Linux1i686exim-mon< 4.92-1.40.amzn1exim-mon-4.92-1.40.amzn1.i686.rpm
Amazon Linux1i686exim-debuginfo< 4.92-1.40.amzn1exim-debuginfo-4.92-1.40.amzn1.i686.rpm
Amazon Linux1x86_64exim-mysql< 4.92-1.40.amzn1exim-mysql-4.92-1.40.amzn1.x86_64.rpm
Amazon Linux1x86_64exim-mon< 4.92-1.40.amzn1exim-mon-4.92-1.40.amzn1.x86_64.rpm
Amazon Linux1x86_64exim-pgsql< 4.92-1.40.amzn1exim-pgsql-4.92-1.40.amzn1.x86_64.rpm
Amazon Linux1x86_64exim< 4.92-1.40.amzn1exim-4.92-1.40.amzn1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	i686	exim-mysql	< 4.92-1.40.amzn1	exim-mysql-4.92-1.40.amzn1.i686.rpm
Amazon Linux	1	i686	exim-pgsql	< 4.92-1.40.amzn1	exim-pgsql-4.92-1.40.amzn1.i686.rpm
Amazon Linux	1	i686	exim-greylist	< 4.92-1.40.amzn1	exim-greylist-4.92-1.40.amzn1.i686.rpm
Amazon Linux	1	i686	exim	< 4.92-1.40.amzn1	exim-4.92-1.40.amzn1.i686.rpm
Amazon Linux	1	i686	exim-mon	< 4.92-1.40.amzn1	exim-mon-4.92-1.40.amzn1.i686.rpm
Amazon Linux	1	i686	exim-debuginfo	< 4.92-1.40.amzn1	exim-debuginfo-4.92-1.40.amzn1.i686.rpm
Amazon Linux	1	x86_64	exim-mysql	< 4.92-1.40.amzn1	exim-mysql-4.92-1.40.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	exim-mon	< 4.92-1.40.amzn1	exim-mon-4.92-1.40.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	exim-pgsql	< 4.92-1.40.amzn1	exim-pgsql-4.92-1.40.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	exim	< 4.92-1.40.amzn1	exim-4.92-1.40.amzn1.x86_64.rpm