Vulnerability · Published May 11, 2020 · Assigned by mitre
CVE-2020-12783
High 7.5
In plain English
A high-severity security flaw in the exim package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.6% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)4.6%top 8.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | exim | 4.93-r1 | ALPINE-CVE-2020-12783 |
| Alpine:v3.21 | exim | 4.93-r1 | ALPINE-CVE-2020-12783 |
| Alpine:v3.22 | exim | 4.93-r1 | ALPINE-CVE-2020-12783 |
| Alpine:v3.23 | exim | 4.93-r1 | ALPINE-CVE-2020-12783 |
| Alpine:v3.24 | exim | 4.93-r1 | ALPINE-CVE-2020-12783 |
| Debian:12 | exim4 | 4.93-16 | DEBIAN-CVE-2020-12783 |
| Debian:13 | exim4 | 4.93-16 | DEBIAN-CVE-2020-12783 |
| Debian:14 | exim4 | 4.93-16 | DEBIAN-CVE-2020-12783 |
Affected products (as reported)
References
- https://bugs.exim.org/show_bug.cgi?id=2571 x_refsource_CONFIRM
- https://git.exim.org/exim.git/commit/57aa14b216432be381b6295c312065b2fd034f86 x_refsource_CONFIRM
- https://git.exim.org/exim.git/commit/a04174dc2a84ae1008c23b6a7109e7fa3fb7b8b0 x_refsource_CONFIRM
- DSA-4687 vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20200518 [SECURITY] [DLA 2213-1] exim4 security update mailing-list, x_refsource_MLIST
- USN-4366-1 vendor-advisory, x_refsource_UBUNTU
- FEDORA-2020-93d7305d71 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-2e084c987d vendor-advisory, x_refsource_FEDORA
- [oss-security] 20210504 21Nails: Multiple vulnerabilities in Exim mailing-list, x_refsource_MLIST