CVE-2020-28018

published 2021-05-06

CVE-2020-28018: Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.

Priority P2 60 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
debian	exim4	< exim4 4.94.2-1 (bookworm)	exim4 4.94.2-1 (bookworm)
exim	exim	>= 4.90 < 4.94.2	4.94.2

Detection & IOCs extracted from sources · hover to see the quote

• → Vulnerable component is Exim 4 before version 4.94.2; detect unpatched Exim instances by banner/version enumeration on SMTP ports ↗
• → The vulnerable code path is in the smtp_reset function; focus audit/monitoring on SMTP session reset handling in Exim processes built with OpenSSL ↗

• · The Use After Free vulnerability in smtp_reset is specifically noted as more likely to be triggered in Exim builds compiled with OpenSSL (as opposed to GnuTLS); assess your build configuration to determine exposure ↗
• · Debian scoped this vulnerability as 'local'; however, smtp_reset is an SMTP-layer function — verify your threat model and network exposure accordingly ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

osv 9.8 CRITICAL

vendor_debian 9.8 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416