The release of the Exim mail server 4.97 has taken place, incorporating accumulated fixes and new features. According to a November automated survey of about 700,000 mail servers, Exim holds a share of 58.73% (down from 60.90% a year ago), Postfix is used on 34.86% (32.49%), Sendmail accounts for 3.46% (3.51%), MailEnable for 1.84% (1.91%), MDaemon for 0.40% (0.42%), and Microsoft Exchange for 0.19% (0.20%).
Key Changes:
- A utility exim_msgdate has been implemented to convert message identifiers (message-id) into a readable format.
- The testing mechanism for string disclosure, triggered when running exim with the '-be' option, now includes the ability to set variables.
- A client-side generated event has been added and server for authentication failure via SMTP AUTH.
- A new variable $sender_helo_verified has been added, containing the result of applying the ACL 'verify = helo'.
- Support for predefined macros for disclosing elements, operators, conditions, and variables has been added.
- Early disclosure of the SMTP option 'max_rcpt' (before its use) has been ensured.
- In the tls_eccurve option for OpenSSL, acceptance of a list of group names has been provided.
- Queue handlers can now be launched from a single background process.
- An operator for splitting long header lines has been added.
- A command-line option has been added to output only message IDs in the queue.
- The ${readsocket} disclosure operator now allows setting SNI for TLS.
- In the ACL modifier remove_header, specification of regular expressions is now permitted.
- A variable $recipients_list has been added, containing a properly escaped list of recipients.
- For log_selector, a parameter has been implemented to reflect incoming connection identifiers.
- Five vulnerabilities discovered in late September have been resolved, three of which (CVE-2023-42115, CVE-2023-42116, CVE-2023-42117) allow remote code execution without authentication on server with the rights of the process accepting connections on port 25, while the remaining two (CVE-2023-42114 and CVE-2023-42119) may lead to memory content leakage of the process servicing network requests.
Source: opennet.ru
