Have you patched the Exim version against the vulnerability?

The vulnerability is for the cPanel version 82.0.14 and 78.0.3.

How to make sure you are safe!

These updates are available in cPanel version 82 and the LTS version 78. You can verify when the updates have been released in the changelogs.

Changelog: https://go.cpanel.net/changelogs

To verify if your server is currently patched against the vulnerability, run the below commands to ensure the Dovecot RPM matches the patched version.

rpm -q dovecot
rpm -qi dovecot
rpm -q exim

Expected response on version 82 and the EDGE tier:

exim-4.92-3.cp1180.x86_64

Expected response on LTS version 78:

exim-4.92-5.cp1178.x86_64

Steps to update if the version is different (For cPanel server)

/scripts/upcp
/scripts/check_cpanel_rpms --fix —long-list

Verify the new Exim RPM was installed:

pm -q --changelog exim | grep CVE-2019-15846

The output on LTS version 78, version 82, and the EDGE tier should resemble below:

Applied upstream patch for CVE-2019-15846


Details about the vulnerability

On Wednesday, September 4, 2019, Exim maintainers announced that they received a report of a potential remote exploit in Exim in versions up to and including 4.92.1.

As of Friday, September 6, 2019, Exim has published a fix for CVE-2019-15846 and cPanel & WHM versions 82.0.14 and 78.0.38 were published with a version of Exim that includes the fix.

Information about which cPanel & WHM versions and Release Tiers are patched to have the correct version of Exim, along with additional details regarding this vulnerability, are available on the document linked below:

=====
https://documentation.cpanel.net/display/CKB/CVE-2019-15846+Exim
=====

New information will be added to this document as it's released. The internal case ID we are using to track this issue is CPANEL-29223. You can verify when the updates have been released for each supported version in our Change Logs: New information will be added to this document as it's released. The internal case ID we are using to track this issue is CPANEL-29669. You can verify when the updates have been released for each supported version in our Change Logs:

=====
https://go.cpanel.net/changelogs
=====

Additionally, on Thursday, September 26, 2019, the Exim maintainers received a bug report about a heap overflow in Exim in versions up to and including 4.92.3.

As of Friday, September 27, 2019, the Exim maintainers released a patch for CVE-2019-16928 and cPanel & WHM versions 82.0.16 and 78.0.40 were published with a version of Exim that includes the patch.

Information about which cPanel & WHM versions and Release Tiers are patched to have the correct version of Exim, along with additional details regarding this vulnerability, are available on the document linked below:

=====
https://documentation.cpanel.net/display/CKB/Exim+CVE-2019-16928
=====

Additional details concerning these vulnerabilities and the updated version of Dovecot can be found at below URLs.

-- Seclist

https://seclists.org/oss-sec/2019/q3/174

-- Dovecot News mailing list

https://dovecot.org/pipermail/dovecot-news/2019-August/000415.html