Path to this page:
./
mail/exim,
The Exim mail transfer agent, a replacement for sendmail
Branch: pkgsrc-2015Q4,
Version: 4.86.2,
Package name: exim-4.86.2,
Maintainer: absExim is a mail transport agent (MTA) developed at the University of Cambridge
for use on Unix systems connected to the Internet. It is freely available
under the terms of the GNU General Public Licence. In style it is similar to
Smail 3, but its facilities are more extensive, and in particular it has
options for verifying incoming sender and recipient addresses, for refusing
mail from specified hosts, networks, or senders, and for controlling mail
relaying.
This build of exim has the following non-default features enabled:
TRANSPORT_LMTP SUPPORT_MAILDIR SUPPORT_MAILSTORE
SUPPORT_MBX AUTH_CRAM_MD5 AUTH_PLAINTEXT
AUTH_SPA SUPPORT_TLS USE_TCP_WRAPPERS
The following default feature is disabled by default, but may be enabled by
setting the 'exim-build-eximon' option:
EXIM_MONITOR
Required to run:[
lang/perl5] [
devel/pcre]
Package options: exim-appendfile-maildir, exim-appendfile-mailstore, exim-appendfile-mbx, exim-content-scan, exim-lookup-dsearch, exim-old-demime, exim-tcp-wrappers, exim-tls, inet6
Master sites: (Expand)
SHA1: 539cb2edc784d439cae8f95940e9eff847e2695d
RMD160: 06790977ad50fb19548826631df904d6bda62a83
Filesize: 1757.145 KB
Version history: (Expand)
- (2016-03-04) Updated to version: exim-4.86.2
- (2016-01-02) Package added to pkgsrc.se, version exim-4.85nb3 (created)
CVS history: (Expand)
2016-03-03 21:22:52 by Benny Siegert | Files touched by this commit (6) |
Log message:
Pullup ticket #4942 - requested by wiedi
mail/exim: security fix
Revisions pulled up:
- mail/exim-html/Makefile 1.30-1.31
- mail/exim-html/PLIST 1.14
- mail/exim-html/distinfo 1.25-1.26
- mail/exim/Makefile 1.142-1.143
- mail/exim/distinfo 1.63-1.64
- mail/exim/patches/patch-aa 1.24
---
Module Name: pkgsrc
Committed By: bsiegert
Date: Sun Jan 10 20:55:57 UTC 2016
Modified Files:
pkgsrc/mail/exim: Makefile distinfo
pkgsrc/mail/exim/patches: patch-aa
Log message:
Update exim to 4.86.
Exim version 4.86
-----------------
JH/01 Bug 1545: The smtp transport option \
"retry_include_ip_address" is now
expanded.
JH/02 The smtp transport option "multi_domain" is now expanded.
JH/03 The smtp transport now requests PRDR by default, if the server offers
it.
JH/04 Certificate name checking on server certificates, when exim is a client,
is now done by default. The transport option tls_verify_cert_hostnames
can be used to disable this per-host. The build option
EXPERIMENTAL_CERTNAMES is withdrawn.
JH/05 The value of the tls_verify_certificates smtp transport and main options
default to the word "system" to access the system default CA \
bundle.
For GnuTLS, only version 3.0.20 or later.
JH/06 Verification of the server certificate for a TLS connection is now tried
(but not required) by default. The verification status is now logged by
default, for both outbound TLS and client-certificate supplying inbound
TLS connections
JH/07 Changed the default rfc1413 lookup settings to disable calls. Few
sites use this now.
JH/08 The EXPERIMENTAL_DSN compile option is no longer needed; all Delivery
Status Notification (bounce) messages are now MIME format per RFC 3464.
Support for RFC 3461 DSN options NOTIFY,ENVID,RET,ORCPT can be advertised
under the control of the dsn_advertise_hosts option, and routers may
have a dsn_lasthop option.
JH/09 A timeout of 2 minutes is now applied to all malware scanner types by
default, modifiable by a malware= option. The list separator for
the options can now be changed in the usual way. Bug 68.
JH/10 The smtp_receive_timeout main option is now expanded before use.
JH/11 The incoming_interface log option now also enables logging of the
local interface on delivery outgoing connections.
JH/12 The cutthrough-routing facility now supports multi-recipient mails,
if the interface and destination host and port all match.
JH/13 Bug 344: The verify = reverse_host_lookup ACL condition now accepts a
/defer_ok option.
JH/14 Bug 1573: The spam= ACL condition now additionally supports Rspamd.
Patch from Andrew Lewis.
JH/15 Bug 670: The spamd_address main option (for the spam= ACL condition)
now supports optional time-restrictions, weighting, and priority
modifiers per server. Patch originally by \
<rommer%active.by@localhost>.
JH/16 The spamd_address main option now supports a mixed list of local
and remote servers. Remote servers can be IPv6 addresses, and
specify a port-range.
JH/17 Bug 68: The spamd_address main option now supports an optional
timeout value per server.
JH/18 Bug 1581: Router and transport options headers_add/remove can
now have the list separator specified.
JH/19 Bug 392: spamd_address, and clamd av_scanner, now support retry
option values.
JH/20 Bug 1571: Ensure that $tls_in_peerdn is set, when verification fails
under OpenSSL.
JH/21 Support for the A6 type of dns record is withdrawn.
JH/22 Bug 608: The result of a QUIT or not-QUIT toplevel ACL now matters
rather than the verbs used.
JH/23 Bug 1572: Increase limit on SMTP confirmation message copy size
from 255 to 1024 chars.
JH/24 Verification callouts now attempt to use TLS by default.
HS/01 DNSSEC options (dnssec_require_domains, dnssec_request_domains)
are generic router options now. The defaults didn't change.
JH/25 Bug 466: Add RFC2322 support for MIME attachment filenames.
Original patch from Alexander Shikoff, worked over by JH.
HS/02 Bug 1575: exigrep falls back to autodetection of compressed
files if ZCAT_COMMAND is not executable.
JH/26 Bug 1539: Add timout/retry options on dnsdb lookups.
JH/27 Bug 286: Support SOA lookup in dnsdb lookups.
JH/28 Bug 1588: Do not use the A lookup following an AAAA for setting the FQDN.
Normally benign, it bites when the pair was led to by a CNAME;
modern usage is to not canoicalize the domain to a CNAME target
(and we were inconsistent anyway for A-only vs AAAA+A).
JH/29 Bug 1632: Removed the word "rejected" from line logged for \
ACL discards.
JH/30 Check the forward DNS lookup for DNSSEC, in addition to the reverse,
when evaluating $sender_host_dnssec.
JH/31 Check the HELO verification lookup for DNSSEC, adding new
$sender_helo_dnssec variable.
JH/32 Bug 1397: Enable ECDHE on OpenSSL, just the NIST P-256 curve.
JH/33 Bug 1346: Note MAIL cmd seen in -bS batch, to avoid smtp_no_mail log.
JH/34 Bug 1648: Fix a memory leak seen with "mailq" and large queues.
JH/35 Bug 1642: Fix support of $spam_ variables at delivery time. Was
documented as working, but never had. Support all but $spam_report.
JH/36 Bug 1659: Guard checking of input smtp commands again pseudo-command
added for tls authenticator.
---
Module Name: pkgsrc
Committed By: adam
Date: Mon Jan 11 08:35:32 UTC 2016
Modified Files:
pkgsrc/mail/exim-html: Makefile PLIST distinfo
Log message:
Match mail/exim version
---
Module Name: pkgsrc
Committed By: wiedi
Date: Wed Mar 2 20:13:18 UTC 2016
Modified Files:
pkgsrc/mail/exim: Makefile distinfo
pkgsrc/mail/exim-html: Makefile distinfo
Log message:
Update mail/exim and mail/exim-html to 4.86.2
Exim version 4.86.2
-------------------
Portability relase of 4.86.1
Exim version 4.86.1
-------------------
HS/04 Add support for keep_environment and add_environment options.
This fixes CVE-2016-1531.
All installations having Exim set-uid root and using 'perl_startup' are
vulnerable to a local privilege escalation. Any user who can start an
instance of Exim (and this is normally *any* user) can gain root
privileges. If you do not use 'perl_startup' you *should* be safe.
New options
-----------
We had to introduce two new configuration options:
keep_environment =
add_environment =
Both options are empty per default. That is, Exim cleans the complete
environment on startup. This affects Exim itself and any subprocesses,
as transports, that may call other programs via some alias mechanisms,
as routers (queryprogram), lookups, and so on. This may affect used
libraries (e.g. LDAP).
** THIS MAY BREAK your existing installation **
If both options are not used in the configuration, Exim issues a warning
on startup. This warning disappears if at least one of these options is
used (even if set to an empty value).
keep_environment should contain a list of trusted environment variables.
(Do you trust PATH?). This may be a list of names and REs.
keep_environment = ^LDAP_ : FOO_PATH
To add (or override) variables, you can use add_environment:
add_environment = <; PATH=/sbin:/usr/sbin
New behaviour
-------------
Now Exim changes it's working directory to / right after startup,
even before reading it's configuration. (Later Exim changes it's working
directory to $spool_directory, as usual.)
Exim only accepts an absolute configuration file path now, when using
the -C option.
|