Out-of-Bounds Read Vulnerability in Exim Email Server

CVE-2020-28025

What is CVE-2020-28025?

The Exim email server prior to version 4.94.2 contains an Out-of-Bounds Read vulnerability. This issue arises from inadequate validation in the pdkim_finish_bodyhash function, where the relationship between sig->bodyhash.len and b->bh.len is not properly checked. An attacker can exploit this vulnerability by crafting a malicious DKIM-Signature header, potentially leaking sensitive information from the process memory of the affected server. This flaw raises significant concerns for data integrity and confidentiality within email communications.

References