Seva yamakalata ya Exim 4.97 yatulutsidwa, ndikuwonjezera zokonza ndikuwonjezera zatsopano. Malinga ndi kafukufuku wodziwikiratu wa Novembala pafupifupi ma seva 700 zikwizikwi, gawo la Exim ndi 58.73% (chaka chapitacho 60.90%), Postfix imagwiritsidwa ntchito pa 34.86% (32.49%) ya ma seva, Sendmail - 3.46% (3.51) %), MailEnable - 1.84% ( 1.91%), MDaemon - 0.40% (0.42%), Microsoft Exchange - 0.19% (0.20%).
Zosintha zazikulu:
- Ntchito ya exim_msgdate yakhazikitsidwa kuti isinthe zozindikiritsa uthenga (ma message-ids) kukhala mawonekedwe.
- Kutha kukhazikitsa zosinthika kwawonjezedwa pamakina oyesera okulitsa zingwe omwe amatchedwa mukamagwiritsa ntchito Exim ndi "-be".
- Chochitika chopangidwa ndi kasitomala chinawonjezeredwa ndi Seva ngati kutsimikizira kudzera pa SMTP AUTH kwalephera.
- Adawonjezedwa $sender_helo_verified variable yokhala ndi zotsatira zogwiritsira ntchito "verify = helo" ACL.
- Thandizo lowonjezera la ma macros omwe adafotokozedweratu pakukulitsa zinthu, ogwiritsa ntchito, mikhalidwe ndi zosintha.
- Kuwonetsetsa kuwululidwa koyambirira (Musanagwiritse ntchito) njira ya SMTP "max_rcpt".
- Njira ya tls_eccurve ya OpenSSL imalola kulandira mndandanda wa mayina amagulu.
- Zothandizira pamzere tsopano zitha kukhazikitsidwa kuchokera kumayendedwe amodzi akumbuyo.
- Wowonjezera wogwiritsa ntchito kuti agawane mizere yamutu wautali.
- Anawonjezera njira ya mzere wolamula kuti muwonetse ma ID a mauthenga okha pamzere.
- Yawonjezera kuthekera kokhazikitsa SNI ya TLS kwa ${readsocket } wowonjezera wowonjezera.
- Mawu okhazikika amaloledwa mu remove_header ACL modifier.
- Adawonjezedwa za $recipients_list zosintha ndi mndandanda wa olandila omwe athawa bwino.
- Anakhazikitsa gawo la log_selector kuti liwonetse ma ID olumikizana omwe akubwera.
- Zofooka zisanu zomwe zinapezeka kumapeto kwa Seputembala zakonzedwa, zitatu mwa izo (CVE-2023-42115, CVE-2023-42116, CVE-2023-42117) zimalola kugwiritsa ntchito ma code akutali popanda kutsimikizira. Seva ndi ufulu wa ndondomekoyi kulandira maulumikizidwe pa doko la netiweki 25, ndi awiri otsalawo (CVE-2023-42114 ndi CVE-2023-42119) kungayambitse kutuluka kwa zomwe zili mu kukumbukira kwa ndondomekoyi popereka mapempho a netiweki.
Source: opennet.ru
