Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 692394 (CVE-2019-13917)

Summary: <mail-mta/exim-4.92.1-r1: ${sort} in configuration leads to privilege escalation (CVE-2019-13917)
Product: Gentoo Security Reporter: GLSAMaker/CVETool Bot <glsamaker>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: major CC: grobian
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: A2 [glsa+ cve]
Package list:
Runtime testing required: ---
Bug Depends on: 693494    
Bug Blocks:    

Description GLSAMaker/CVETool Bot gentoo-dev 2019-08-17 22:44:30 UTC
CVE-2019-13917 (
  Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as
  root in some unusual configurations that use the ${sort } expansion for
  items that can be controlled by an attacker (e.g., $local_part or $domain).
Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev 2019-09-06 15:38:26 UTC
New GLSA request filed.
Comment 2 GLSAMaker/CVETool Bot gentoo-dev 2019-09-07 00:25:21 UTC
This issue was resolved and addressed in
 GLSA 201909-06 at
by GLSA coordinator Thomas Deutschmann (whissi).