CVE-2020-28025

Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship between sig->bodyhash.len and b->bh.len; thus, a crafted DKIM-Signature header might lead to a leak of sensitive information from process memory.

Affected products

Alt Linux, Astra Linux, Exim, Linuxmint, Suse, Ubuntu

Exim

< 4.94.2

Fix

Available

CVSS 3.1

7.5 HIGH

EPSS

2.8% (85th percentile)

Weakness

CWE-125

NVD status

Modified

Published

2021-05-06