A corrective release of the Exim mail server 4.97.1 is available, which includes changes to protect against the SMTP Smuggling attack that allows a single message to be split into several different messages through the use of a non-standard sequence for separating emails. Initially, it was assumed that the issue only affected Postfix and Sendmail, but it was later determined that it also impacts Exim (CVE-2023-51766).
Exim can handle message separators such as "\n.\n", "\r\n.\n", and "\n.\r\n" if support for the "PIPELINING" and "CHUNKING" extensions is enabled on the server for incoming connections. The fix includes the strict_crlf setting, allowing the handling of non-standard sequences to be restored. As a workaround for protection, the "PIPELINING" or "CHUNKING" extension can be disabled using the pipelining_advertise_hosts, pipelining_connect_advertise_hosts, and chunking_advertise_hosts settings.
Source: opennet.ru
