CVE-2019-10149
exim4: A flaw was found in Exim versions 4.87 to 4.91 (inclusive)
CVE-2019-10149 is fixed in 6 products on 1 platform, first by exim4 4.90.1-1ubuntu1.2, released June 3, 2019. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on January 10, 2022. Patch Radar priority: Patch now.
Patch nowCISA KEV
CVSS
n/a
Medium
Exploitation
Exploited
Listed by CISA
CISA KEV
Jan 10, 2022
Federal due date Jul 10, 2022
EPSS
0.9996
99th percentile
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| exim4 · Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.2 | exim4 4.90.1-1ubuntu1.2 | Jun 3, 2019 |
| exim4-base · Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.2 | exim4-base 4.90.1-1ubuntu1.2 | Jun 3, 2019 |
| exim4-config · Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.2 | exim4-config 4.90.1-1ubuntu1.2 | Jun 3, 2019 |
| exim4-daemon-heavy · Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.2 | exim4-daemon-heavy 4.90.1-1ubuntu1.2 | Jun 3, 2019 |
| exim4-daemon-light · Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.2 | exim4-daemon-light 4.90.1-1ubuntu1.2 | Jun 3, 2019 |
| eximon4 · Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.2 | eximon4 4.90.1-1ubuntu1.2 | Jun 3, 2019 |