Docs: Security release. Bug 3063

[exim.git] / doc / doc-txt / ChangeLog

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index c36718d7efeab21ea28d542ab21f47790442208e..c88454c1e2ea0be01f03b671d4acc57d4ab3bfae 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -2,33 +2,13 @@ This document describes *changes* to previous versions, that might
 affect Exim's operation, with an unchanged configuration file.  For new
 options, and new features, see the NewStuff file next to this ChangeLog.
 
-Exim version 4.96.1
--------------------
-
-This is a security release.
-
-JH/01 Bug 2999: Fix a possible OOB write in the external authenticator, which
-      could be triggered by externally-supplied input.  Found by Trend Micro.
-      CVE-2023-42115
-
-JH/02 Bug 3000: Fix a possible OOB write in the SPA authenticator, which could
-      be triggered by externally-controlled input.  Found by Trend Micro.
-      CVE-2023-42116
+Since Exim version 4.97
+-----------------------
 
-JH/03 Bug 3001: Fix a possible OOB read in the SPA authenticator, which could
-      be triggered by externally-controlled input.  Found by Trend Micro.
-      CVE-2023-42114
-
-
-JH/04 Bug 2903: avoid exit on an attempt to rewrite a malformed address.
-      Make the rewrite never match and keep the logging.  Trust the
-      admin to be using verify=header-syntax (to actually reject the message).
-
-
-Exim version 4.next
--------------------
-
-HS/01 Fix string_is_ip_address() CVE-2023-42117 (Bug 3031)
+JH/s1 Refuse to accept a line "dot, LF" as end-of-DATA unless operating in
+      LF-only mode (as detected from the first header line).  Previously we did
+      accept that in (normal) CRLF mode; this has been raised as a possible
+      attack scenario (under the name "smtp smuggling", CVE-2023-51766).
 
 
 Exim version 4.97
@@ -117,7 +97,7 @@ JH/18 Fix a fencepost error in logging.  Previously (since 4.92) when a log line
 
 JH/19 Bug 2911: Fix a recursion in DNS lookups.  Previously, if the main option
       dns_again_means_nonexist included an element causing a DNS lookup which
-      iteslf returned DNS_AGAIN, unbounded recursion occurred.  Possible results
+      itself returned DNS_AGAIN, unbounded recursion occurred.  Possible results
       included (though probably not limited to) a process crash from stack
       memory limit, or from excessive open files.  Replace this with a paniclog
       whine (as this is likely a configuration error), and returning
@@ -222,14 +202,31 @@ JH/38 Taint-track intermediate values from the peer in multi-stage authentation
 JH/39 Bug 3023: Fix crash induced by some combinations of zero-length strings
       and ${tr...}.  Found and diagnosed by Heiko Schlichting.
 
-JH/40 Support list of dkim results in the dkim_status ACL condition, making
-      it more usable in the data ACL.
+JH/40 Bug 2999: Fix a possible OOB write in the external authenticator, which
+      could be triggered by externally-supplied input.  Found by Trend Micro.
+      CVE-2023-42115
+
+JH/41 Bug 3000: Fix a possible OOB write in the SPA authenticator, which could
+      be triggered by externally-controlled input.  Found by Trend Micro.
+      CVE-2023-42116
+
+JH/42 Bug 3001: Fix a possible OOB read in the SPA authenticator, which could
+      be triggered by externally-controlled input.  Found by Trend Micro.
+      CVE-2023-42114
+
+JH/43 Bug 2903: avoid exit on an attempt to rewrite a malformed address.
+      Make the rewrite never match and keep the logging.  Trust the
+      admin to be using verify=header-syntax (to actually reject the message).
+
+JH/44 Bug 3033: Harden dnsdb lookups against crafted DNS responses.
+      CVE-2023-42219
 
+HS/02 Fix string_is_ip_address() CVE-2023-42117 (Bug 3031)
 
 Exim version 4.96
 -----------------
 
-JH/01 Move the wait-for-next-tick (needed for unique messmage IDs) from
+JH/01 Move the wait-for-next-tick (needed for unique message IDs) from
       after reception to before a subsequent reception.  This should
       mean slightly faster delivery, and also confirmation of reception
       to senders.