crítica
CVE-2025-26794
exim: Exim: remote SQL injection
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (alta).
Descripción
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 13 | exim4 | 4.98-4 |
| debian 14 | exim4 | 4.98-4 |
| rapidfort alpine 3.20 | exim | 4.98.1-r0 |
| rapidfort alpine 3.21 | exim | 4.98.1-r0 |
| rapidfort alpine 3.22 | exim | 4.98.1-r0 |
| rapidfort alpine 3.23 | exim | 4.98.1-r0 |
| rapidfort alpine 3.24 | exim | 4.98.1-r0 |
| rapidfort debian 12 | exim4 | 0:4.98-4 |
| rapidfort debian 13 | exim4 | 0:4.98-4 |
| rapidfort fedora 43 | exim, exim-clamav, exim-greylist y 3 más | 4.99.1-1.fc43 |
| rapidfort Oracle Linux 10 | exim, exim-clamav, exim-greylist y 3 más | 4.99.1-1.el10_2 |
| rapidfort Oracle Linux 9 | exim, exim-clamav, exim-greylist y 3 más | 4.99.1-1.el9 |
Mostrar las 27 entradas de 12 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 13 | exim4 | 4.98-4 |
| debian 14 | exim4 | 4.98-4 |
| rapidfort alpine 3.20 | exim | 4.98.1-r0 |
| rapidfort alpine 3.21 | exim | 4.98.1-r0 |
| rapidfort alpine 3.22 | exim | 4.98.1-r0 |
| rapidfort alpine 3.23 | exim | 4.98.1-r0 |
| rapidfort alpine 3.24 | exim | 4.98.1-r0 |
| rapidfort debian 12 | exim4 | 0:4.98-4 |
| rapidfort debian 13 | exim4 | 0:4.98-4 |
| rapidfort fedora 43 | exim | 4.99.1-1.fc43 |
| rapidfort fedora 43 | exim-clamav | 4.99.1-1.fc43 |
| rapidfort fedora 43 | exim-greylist | 4.99.1-1.fc43 |
| rapidfort fedora 43 | exim-mon | 4.99.1-1.fc43 |
| rapidfort fedora 43 | exim-mysql | 4.99.1-1.fc43 |
| rapidfort fedora 43 | exim-pgsql | 4.99.1-1.fc43 |
| rapidfort Oracle Linux 10 | exim | 4.99.1-1.el10_2 |
| rapidfort Oracle Linux 10 | exim-clamav | 4.99.1-1.el10_2 |
| rapidfort Oracle Linux 10 | exim-greylist | 4.99.1-1.el10_2 |
| rapidfort Oracle Linux 10 | exim-mon | 4.99.1-1.el10_2 |
| rapidfort Oracle Linux 10 | exim-mysql | 4.99.1-1.el10_2 |
| rapidfort Oracle Linux 10 | exim-pgsql | 4.99.1-1.el10_2 |
| rapidfort Oracle Linux 9 | exim | 4.99.1-1.el9 |
| rapidfort Oracle Linux 9 | exim-clamav | 4.99.1-1.el9 |
| rapidfort Oracle Linux 9 | exim-greylist | 4.99.1-1.el9 |
| rapidfort Oracle Linux 9 | exim-mon | 4.99.1-1.el9 |
| rapidfort Oracle Linux 9 | exim-mysql | 4.99.1-1.el9 |
| rapidfort Oracle Linux 9 | exim-pgsql | 4.99.1-1.el9 |
Referencias
- http://www.openwall.com/lists/oss-security/2025/02/19/1
- http://www.openwall.com/lists/oss-security/2025/02/21/4
- http://www.openwall.com/lists/oss-security/2025/02/21/5
- https://access.redhat.com/security/cve/CVE-2025-26794
- https://bugzilla.suse.com/show_bug.cgi?id=1237424
- https://code.exim.org/exim/exim/commit/bfe32b5c6ea033736a26da8421513206db9fe305
- https://exim.org
- https://exim.org/static/doc/security/EXIM-Security-2025-12-09.1/report.txt
Las 14 referencias
- https://github.com/Exim/exim/wiki/EximSecurity
- https://github.com/NixOS/nixpkgs/pull/383926
- https://github.com/openbsd/ports/commit/584d2c49addce9ca0ae67882cc16969104d7f82d
- https://nvd.nist.gov/vuln/detail/CVE-2025-26794
- https://www.cve.org/CVERecord?id=CVE-2025-26794
- https://www.exim.org/static/doc/security/CVE-2025-26794.txt