CVE-2020-12783

NameCVE-2020-12783
DescriptionExim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2213-1, DSA-4687-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
exim4 (PTS)jessie4.84.2-2+deb8u5vulnerable
jessie (security)4.84.2-2+deb8u7fixed
stretch4.89-2+deb9u6vulnerable
stretch (security)4.89-2+deb9u7fixed
buster4.92-8+deb10u3vulnerable
buster (security)4.92-8+deb10u4fixed
bullseye4.93-16fixed
sid4.94-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
exim4source(unstable)4.93-16
exim4sourcebuster4.92-8+deb10u4DSA-4687-1
exim4sourcejessie4.84.2-2+deb8u7DLA-2213-1
exim4sourcestretch4.89-2+deb9u7DSA-4687-1

Notes

https://bugs.exim.org/show_bug.cgi?id=2571
https://git.exim.org/exim.git/commitdiff/57aa14b216432be381b6295c312065b2fd034f86
https://git.exim.org/exim.git/commitdiff/a04174dc2a84ae1008c23b6a7109e7fa3fb7b8b0

Search for package or bug name: Reporting problems