USN-3164-1: Exim vulnerability
Ubuntu Security Notice USN-3164-1
5th January, 2017
exim4 vulnerability
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 16.10
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary
Exim could be made to expose private DKIM signing keys.
Software description
- exim4
– Exim is a mail transport agent
Details
Bjoern Jacke discovered that Exim incorrectly handled DKIM keys. In certain
configurations, private DKIM signing keys could be leaked to the log files.
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 16.10:
-
exim4-daemon-heavy
4.87-3ubuntu1.1
-
exim4-daemon-light
4.87-3ubuntu1.1
- Ubuntu 16.04 LTS:
-
exim4-daemon-heavy
4.86.2-2ubuntu2.1
-
exim4-daemon-light
4.86.2-2ubuntu2.1
- Ubuntu 14.04 LTS:
-
exim4-daemon-heavy
4.82-3ubuntu2.2
-
exim4-daemon-light
4.82-3ubuntu2.2
- Ubuntu 12.04 LTS:
-
exim4-daemon-heavy
4.76-3ubuntu3.4
-
exim4-daemon-light
4.76-3ubuntu3.4
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
References
Source: USN-3164-1: Exim vulnerability
