Exim4 - Private DKIM Signing Key Leakage
Summary
DLA-762-1: exim4 - security update. Affects exim4 versions < 4.80-7+deb7u4. Fixed in 4.80-7+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Exim4 is a popular mail transfer agent (MTA) used in Debian 7 Wheezy. It is the default MTA for Debian and is responsible for routing and delivering email messages. Exim4 provides a flexible and customizable solution for handling email communication.
Vulnerability Detail
The vulnerability in Exim4 allows for the leakage of the private DKIM signing key to the log files under specific configuration options. This means that an attacker with access to the log files could potentially obtain the private key, compromising the integrity and authenticity of DKIM-signed emails. The issue was discovered by Bjoern Jacke.
How To Fix
Minimum fixed version
4.80-7+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade exim4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to mitigate the risk of private key leakage.
Conclusion
The Exim4 vulnerability allows for the leakage of the private DKIM signing key, which can compromise the integrity and authenticity of DKIM-signed emails. It is crucial to upgrade the exim4 packages to the fixed version to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for exim4 →
FAQ
Exim4 is a mail transfer agent (MTA) used for routing and delivering email messages. It is the default MTA in Debian 7 Wheezy.
A DKIM signing key is used to digitally sign outgoing emails, providing a means to verify the authenticity and integrity of the email.
If an attacker gains access to the log files containing the private DKIM signing key, they can use it to forge DKIM signatures and potentially impersonate the sender or modify the content of DKIM-signed emails.
There is no evidence of active exploitation of this vulnerability at the time of this advisory. However, it is crucial to apply the security update to prevent any potential future exploitation.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, on the Debian LTS wiki: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for exim4.
