Package: release.debian.org
Severity: normal
User: release.debian....@packages.debian.org
Usertags: unblock
Please unblock package exim4. This is a minimal single-bugfix upload
for #697057.
Debian's exim configuration optionally allows to use spfquery to run
SPF-checks on incoming mail. Due to insufficient quoting it is
possible to pass on arbitrary arguments to spfquery and therefore
bypass SPF checks.
unblock exim4/4.80-7
thanks, cu andreas
File lists identical (after any substitutions)
Control files of package exim4: lines which differ (wdiff format)
-----------------------------------------------------------------
Version: [-4.80-6-] {+4.80-7+}
Control files of package exim4-base: lines which differ (wdiff format)
----------------------------------------------------------------------
Version: [-4.80-6-] {+4.80-7+}
Control files of package exim4-config: lines which differ (wdiff format)
------------------------------------------------------------------------
Version: [-4.80-6-] {+4.80-7+}
Control files of package exim4-daemon-heavy: lines which differ (wdiff format)
------------------------------------------------------------------------------
Version: [-4.80-6-] {+4.80-7+}
Control files of package exim4-daemon-heavy-dbg: lines which differ (wdiff format)
----------------------------------------------------------------------------------
Version: [-4.80-6-] {+4.80-7+}
Control files of package exim4-daemon-light: lines which differ (wdiff format)
------------------------------------------------------------------------------
Version: [-4.80-6-] {+4.80-7+}
Control files of package exim4-daemon-light-dbg: lines which differ (wdiff format)
----------------------------------------------------------------------------------
Version: [-4.80-6-] {+4.80-7+}
Control files of package exim4-dbg: lines which differ (wdiff format)
---------------------------------------------------------------------
Version: [-4.80-6-] {+4.80-7+}
Control files of package exim4-dev: lines which differ (wdiff format)
---------------------------------------------------------------------
Version: [-4.80-6-] {+4.80-7+}
Control files of package eximon4: lines which differ (wdiff format)
-------------------------------------------------------------------
Version: [-4.80-6-] {+4.80-7+}
diff -Nru exim4-4.80/debian/changelog exim4-4.80/debian/changelog
--- exim4-4.80/debian/changelog 2012-11-21 19:08:56.000000000 +0100
+++ exim4-4.80/debian/changelog 2013-01-02 19:37:26.000000000 +0100
@@ -1,3 +1,11 @@
+exim4 (4.80-7) unstable; urgency=low
+
+ * Use exim's ${quote:xxx} operator when invoking spfquery to disallow
+ bypassing of SPF validation by using special mailbox names. (Thanks to
+ Lekensteyn for diagnosis and testing.) Closes: #697057
+
+ -- Andreas Metzler <ametz...@debian.org> Wed, 02 Jan 2013 19:37:21 +0100
+
exim4 (4.80-6) unstable; urgency=low
* Cherrypick two changes from GIT:
diff -Nru exim4-4.80/debian/debconf/conf.d/acl/30_exim4-config_check_rcpt exim4-4.80/debian/debconf/conf.d/acl/30_exim4-config_check_rcpt
--- exim4-4.80/debian/debconf/conf.d/acl/30_exim4-config_check_rcpt 2012-09-23 12:07:23.000000000 +0200
+++ exim4-4.80/debian/debconf/conf.d/acl/30_exim4-config_check_rcpt 2013-01-02 19:36:16.000000000 +0100
@@ -265,10 +265,10 @@
log_message = SPF check failed.
!acl = acl_local_deny_exceptions
condition = ${run{/usr/bin/spfquery.mail-spf-perl --ip \
- \"$sender_host_address\" --identity \
+ ${quote:$sender_host_address} --identity \
${if def:sender_address_domain \
- {--scope mfrom --identity \"$sender_address\"}\
- {--scope helo --identity \"$sender_helo_name\"}}}\
+ {--scope mfrom --identity ${quote:$sender_address}}\
+ {--scope helo --identity ${quote:$sender_helo_name}}}}\
{no}{${if eq {$runrc}{1}{yes}{no}}}}
defer
