Log in Start free

Actively exploited · Published Jun 5, 2019 · Assigned by redhat

CVE-2019-10149

Critical 9.0 Exploited

In plain English

A critical-severity OS command injection in exim from exim. Attackers are actively exploiting it in the wild (listed by CISA on January 10, 2022). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)9.0Critical
Exploit odds (30 days)100.0%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Jan 10, 2022
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jul 10, 2022.

Official description

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20exim4.92-r0ALPINE-CVE-2019-10149
Alpine:v3.21exim4.92-r0ALPINE-CVE-2019-10149
Alpine:v3.22exim4.92-r0ALPINE-CVE-2019-10149
Alpine:v3.23exim4.92-r0ALPINE-CVE-2019-10149
Alpine:v3.24exim4.92-r0ALPINE-CVE-2019-10149
Debian:12exim44.92~RC3-1DEBIAN-CVE-2019-10149
Debian:13exim44.92~RC3-1DEBIAN-CVE-2019-10149
Debian:14exim44.92~RC3-1DEBIAN-CVE-2019-10149

Affected products (as reported)

VendorProductVersions
exim exim 4.92

Weakness: CWE-78 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References