critique
CVE-2019-13917
exim: ${sort} in configuration leads to privilege escalation
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (élevée), Amazon (élevée), Ubuntu (moyenne).
Description
Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $local_part or $domain).
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.10 | exim | 4.92.1-r0 |
| alpine 3.11 | exim | 4.92.1-r0 |
| alpine 3.12 | exim | 4.92.1-r0 |
| alpine 3.13 | exim | 4.92.1-r0 |
| alpine 3.14 | exim | 4.92.1-r0 |
| alpine 3.15 | exim | 4.92.1-r0 |
| alpine 3.16 | exim | 4.92.1-r0 |
| alpine 3.17 | exim | 4.92.1-r0 |
| alpine 3.18 | exim | 4.92.1-r0 |
| alpine 3.19 | exim | 4.92.1-r0 |
| alpine 3.20 | exim | 4.92.1-r0 |
| alpine 3.21 | exim | 4.92.1-r0 |
Afficher les 35 entrées de 30 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.10 | exim | 4.92.1-r0 |
| alpine 3.11 | exim | 4.92.1-r0 |
| alpine 3.12 | exim | 4.92.1-r0 |
| alpine 3.13 | exim | 4.92.1-r0 |
| alpine 3.14 | exim | 4.92.1-r0 |
| alpine 3.15 | exim | 4.92.1-r0 |
| alpine 3.16 | exim | 4.92.1-r0 |
| alpine 3.17 | exim | 4.92.1-r0 |
| alpine 3.18 | exim | 4.92.1-r0 |
| alpine 3.19 | exim | 4.92.1-r0 |
| alpine 3.20 | exim | 4.92.1-r0 |
| alpine 3.21 | exim | 4.92.1-r0 |
| alpine 3.22 | exim | 4.92.1-r0 |
| alpine 3.23 | exim | 4.92.1-r0 |
| alpine 3.24 | exim | 4.92.1-r0 |
| alpine 3.9 | exim | 4.92.1-r0 |
| alpine edge | exim | 4.92.1-r0 |
| amazon linux 1 | exim | 4.92-1.23.amzn1 |
| amazon linux 1 | exim-debuginfo | 4.92-1.23.amzn1 |
| amazon linux 1 | exim-greylist | 4.92-1.23.amzn1 |
| amazon linux 1 | exim-mon | 4.92-1.23.amzn1 |
| amazon linux 1 | exim-mysql | 4.92-1.23.amzn1 |
| amazon linux 1 | exim-pgsql | 4.92-1.23.amzn1 |
| debian 10 | exim4 | 4.92-8+deb10u1 |
| debian 11 | exim4 | 4.92-10 |
| debian 12 | exim4 | 4.92-10 |
| debian 13 | exim4 | 4.92-10 |
| debian 14 | exim4 | 4.92-10 |
| debian 9 | exim4 | 4.89-2+deb9u5 |
| echo | exim4 | 4.92-10 |
| ubuntu 16.04 | exim4 | 4.86.2-2ubuntu2.4 |
| ubuntu 16.04-ESM | exim4 | 4.86.2-2ubuntu2.4 |
| ubuntu 18.04 | exim4 | 4.90.1-1ubuntu1.3 |
| ubuntu 18.04-ESM | exim4 | 4.90.1-1ubuntu1.3 |
| ubuntu 19.04 | exim4 | 4.92-4ubuntu1.2 |
Références
- http://exim.org/static/doc/security/CVE-2019-13917.txt
- http://www.openwall.com/lists/oss-security/2019/07/26/5
- https://access.redhat.com/security/cve/CVE-2019-13917
- https://nvd.nist.gov/vuln/detail/CVE-2019-13917
- https://seclists.org/bugtraq/2019/Jul/51
- https://security.gentoo.org/glsa/201909-06
- https://ubuntu.com/security/notices/USN-4075-1
- https://www.cve.org/CVERecord?id=CVE-2019-13917