Exim 4.92.3 idasindikizidwa ndikuchotsa kusatetezeka kwachinayi mchaka chimodzi

Lofalitsidwa seva yamakalata kumasulidwa kwapadera Chithunzi 4.92.3 ndi kuchotsedwa kwa wina kusatetezeka kwambiri (CVE-2019-16928), zomwe zingakulolezeni kuti mugwiritse ntchito code yanu pa seva podutsa chingwe chopangidwa mwapadera mu lamulo la EHLO. Chiwopsezochi chikuwonekera pa siteji pambuyo poti mwayi wakhazikitsidwanso ndipo umangokhala pakugwiritsa ntchito ma code ndi ufulu wa wogwiritsa ntchito molakwika, pomwe woyendetsa uthenga wobwera amaphedwa.

Vutoli limangowoneka munthambi ya Exim 4.92 (4.92.0, 4.92.1 ndi 4.92.2) ndipo silimadutsana ndi kusatetezeka komwe kumakhazikitsidwa kumayambiriro kwa mwezi. CVE-2019-15846. Kusatetezeka kumadza chifukwa cha kusefukira kwa buffer mu ntchito chingwe_vformat(), yofotokozedwa mu fayilo string.c. Zowonetsera dyera masuku pamutu amakulolani kuti muwonongeke podutsa chingwe chachitali (ma kilobytes angapo) mu lamulo la EHLO, koma chiopsezocho chikhoza kugwiritsidwa ntchito kupyolera mu malamulo ena, komanso chingagwiritsidwe ntchito pokonzekera kuphedwa kwa code.

Palibe njira zogwirira ntchito zoletsa kusatetezeka, chifukwa chake ogwiritsa ntchito onse akulimbikitsidwa kukhazikitsa zosinthazo mwachangu, kugwiritsa ntchito. chigamba kapena onetsetsani kuti mukugwiritsa ntchito mapaketi operekedwa ndi magawo omwe ali ndi zosintha pazovuta zomwe zikuchitika. Hotfix yatulutsidwa Ubuntu (imangokhudza nthambi 19.04), Arch Linux, FreeBSD, Debian (imangokhudza Debian 10 Buster) ndi Fedora. RHEL ndi CentOS sizikukhudzidwa ndi vutoli, chifukwa Exim sichikuphatikizidwa muzosungira zawo zokhazikika (mu EPEL7 sinthani pano akusowa). Mu SUSE/openSUSE chiwopsezo sichikuwoneka chifukwa chogwiritsa ntchito nthambi ya Exim 4.88.

Source: opennet.ru

Kuwonjezera ndemanga