Security readout for executives and security teams
Plain-English summary
CVE-2020-28025 is an Exim mail server memory disclosure issue. A specially crafted DKIM-Signature header could cause Exim to read beyond expected memory bounds and potentially expose sensitive process memory. The provided sources identify affected versions only as Exim before 4.94.2.
Executive priority
Treat this as a targeted mail infrastructure update priority, not a confirmed emergency. Patch exposed Exim servers first because mail servers routinely process untrusted messages and may hold sensitive operational data in memory.
Technical view
In Exim before 4.94.2, pdkim_finish_bodyhash fails to validate the relationship between sig->bodyhash.len and b->bh.len. This can produce an out-of-bounds read during DKIM body hash handling, with potential leakage of sensitive information from Exim process memory.
Likely exposure
Exposure is most likely on systems running Exim before 4.94.2, especially mail servers processing inbound messages with DKIM-Signature headers. The bundle does not identify specific operating system packages, configurations, or CPEs.
Exploitation context
The provided bundle does not show CISA KEV listing or cite active exploitation. Exploitation requires a crafted DKIM-Signature header, but the sources do not provide evidence of exploitation in the wild.
Researcher notes
Evidence is limited but specific: the flaw is an out-of-bounds read in DKIM body hash completion before Exim 4.94.2. No CVSS, CWE, KEV status, or exploitation evidence is provided in the bundle.
Mitigation direction
- Upgrade Exim to 4.94.2 or later following vendor or distribution guidance.
- Inventory internet-facing and internal Exim servers for versions before 4.94.2.
- Prioritize externally reachable mail servers that process untrusted inbound email.
- Review vendor and distribution advisories for backported fixes.
- Monitor mail service logs for unusual DKIM parsing errors or crashes.
Validation and detection
- Confirm the installed Exim version on every mail server.
- Verify distribution package changelogs for the CVE-2020-28025 fix or backport.
- Confirm DKIM processing paths are covered by patched Exim builds.
- Review exposure of SMTP services accepting external mail.
- Document remediation status for all Exim instances.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-28025 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28025-BHASH.txtCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.