Bug#992172: exim4: CVE-2021-38371

[Salvatore Bonaccorso]

Source: exim4
Version: 4.94.2-7
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for exim4, this is to start
tracking the issue downstream for us. Note that at time of writing [2]
gives still a 404.

CVE-2021-38371[0]:
| The STARTTLS feature in Exim through 4.94.2 allows response injection
| (buffering) during MTA SMTP sending.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-38371
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38371
[1] https://nostarttls.secvuln.info
[2] https://www.exim.org/static/doc/security/CVE-2021-38371.txt

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore