{"$ref":"https://www.cert.ssi.gouv.fr/openapi.json","affected_systems":[{"description":"Exim versions ant\u00e9rieures \u00e0 4.94","product":{"name":"N/A","vendor":{"name":"Exim","scada":false}}}],"affected_systems_content":null,"closed_at":"2021-06-10","content":"## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l'\u00e9diteur pour l'obtention des\ncorrectifs (cf. section Documentation).\n","cves":[{"name":"CVE-2021-27216","url":"https://www.cve.org/CVERecord?id=CVE-2021-27216"},{"name":"CVE-2020-28013","url":"https://www.cve.org/CVERecord?id=CVE-2020-28013"},{"name":"CVE-2020-28026","url":"https://www.cve.org/CVERecord?id=CVE-2020-28026"},{"name":"CVE-2020-28009","url":"https://www.cve.org/CVERecord?id=CVE-2020-28009"},{"name":"CVE-2020-28023","url":"https://www.cve.org/CVERecord?id=CVE-2020-28023"},{"name":"CVE-2020-28011","url":"https://www.cve.org/CVERecord?id=CVE-2020-28011"},{"name":"CVE-2020-28022","url":"https://www.cve.org/CVERecord?id=CVE-2020-28022"},{"name":"CVE-2020-28008","url":"https://www.cve.org/CVERecord?id=CVE-2020-28008"},{"name":"CVE-2020-28021","url":"https://www.cve.org/CVERecord?id=CVE-2020-28021"},{"name":"CVE-2020-28024","url":"https://www.cve.org/CVERecord?id=CVE-2020-28024"},{"name":"CVE-2020-28018","url":"https://www.cve.org/CVERecord?id=CVE-2020-28018"},{"name":"CVE-2020-28010","url":"https://www.cve.org/CVERecord?id=CVE-2020-28010"},{"name":"CVE-2020-28017","url":"https://www.cve.org/CVERecord?id=CVE-2020-28017"},{"name":"CVE-2020-28012","url":"https://www.cve.org/CVERecord?id=CVE-2020-28012"},{"name":"CVE-2020-28007","url":"https://www.cve.org/CVERecord?id=CVE-2020-28007"},{"name":"CVE-2020-28020","url":"https://www.cve.org/CVERecord?id=CVE-2020-28020"},{"name":"CVE-2020-28015","url":"https://www.cve.org/CVERecord?id=CVE-2020-28015"},{"name":"CVE-2020-28016","url":"https://www.cve.org/CVERecord?id=CVE-2020-28016"},{"name":"CVE-2020-28025","url":"https://www.cve.org/CVERecord?id=CVE-2020-28025"},{"name":"CVE-2020-28014","url":"https://www.cve.org/CVERecord?id=CVE-2020-28014"},{"name":"CVE-2020-28019","url":"https://www.cve.org/CVERecord?id=CVE-2020-28019"}],"links":[{"title":"BlogPost de Qualys concernant les vuln\u00e9rabilit\u00e9s","url":"https://blog.qualys.com/vulnerabilities-research/2021/05/04/21nails-multiple-vulnerabilities-in-exim-mail-server"}],"reference":"CERTFR-2021-ALE-008","revisions":[{"description":"Version initiale","revision_date":"2021-05-05T00:00:00.000000"},{"description":"Cl\u00f4ture de l'alerte. Cela ne signifie pas la fin d'une menace. Seule l'application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l'exploitation de la vuln\u00e9rabilit\u00e9 correspondante.","revision_date":"2021-06-10T00:00:00.000000"}],"risks":[{"description":"Ex\u00e9cution de code arbitraire \u00e0 distance"},{"description":"\u00c9l\u00e9vation de privil\u00e8ges"},{"description":"Contournement de la politique de s\u00e9curit\u00e9"},{"description":"Non sp\u00e9cifi\u00e9 par l'\u00e9diteur"}],"summary":"Le 5 mai 2021, Qualys a publi\u00e9 un bulletin de s\u00e9curit\u00e9 contenant 21\nvuln\u00e9rabilit\u00e9s affectant le serveur mail Exim. Quatre de ces\nvuln\u00e9rabilit\u00e9s permettent une \u00e9l\u00e9vation de privil\u00e8ge et trois une\nex\u00e9cution de code arbitraire. Ces vuln\u00e9rabilit\u00e9s affectent toutes les\nversions de Exim ant\u00e9rieures \u00e0 4.94 et permettent *in fine*<span\nclass=\"mx_MTextBody mx_EventTile_content\"><span\nclass=\"mx_EventTile_body markdown-body\" dir=\"auto\"> \u00e0 un attaquant non\nauthentifi\u00e9 de prendre le contr\u00f4le du serveur mail <span\nclass=\"mx_EventTile_body\" dir=\"auto\">avec les privil\u00e8ges du compte\n*root*.</span>  \n</span></span>\n","title":"Multiples vuln\u00e9rabilit\u00e9s dans Exim","vendor_advisories":[{"published_at":null,"title":"Bulletin de s\u00e9curit\u00e9 Exim du 5 mai 2021","url":null}]}