CVE-2020-28026: 
Exim vulnerability analysis and mitigation

CVE-2020-28026 affects Exim versions before 4.94.2 and involves line truncation and injection in spoolreadheader(). This vulnerability is particularly relevant in non-default configurations that enable Delivery Status Notifications (DSN). The issue was discovered during a comprehensive security audit conducted by Qualys, which revealed a total of 21 vulnerabilities in Exim (dubbed "21Nails") (Qualys Advisory).

The vulnerability is classified as a remote vulnerability that allows line truncation and injection in the spoolreadheader() function of Exim. It is one of the 10 remote vulnerabilities discovered in the "21Nails" audit. The issue was patched in Exim version 4.94.2, released in May 2021 (Ubuntu Notice).

When exploited, this vulnerability could potentially allow attackers to cause denial of service, execute arbitrary code remotely, obtain sensitive information, or escalate local privileges, depending on the specific configuration and exploitation method (Ubuntu Notice).

The primary mitigation is to upgrade Exim to version 4.94.2 or later. For Ubuntu systems, specific package versions were released to address this vulnerability: Ubuntu 21.04 (4.94-15ubuntu1.2), Ubuntu 20.10 (4.94-7ubuntu1.2), Ubuntu 20.04 (4.93-13ubuntu1.5), and Ubuntu 18.04 (4.90.1-1ubuntu1.8) (Ubuntu Notice).