Package: exim4-daemon-heavy Version: 4.92-7 Severity: important Dear Maintainer,
The following is currently just an observation, as we haven't been able to reproduce the problem yet. It might be caused by faulty memory on the affected server but it could also be related to CVE-2019-10149 fixes, which where applied just before we saw the problem for the first time: Observations: * Four days ago, we recognized some frozen Mails in one of our exim4 mail queues with error messages like "spool format error: size=9934 ***" * While inspecting the Spool directories, we found unrelated data concatenated to all affected /var/spool/exim4/input/*-H files. Mostly parts of /etc/aliases (mostly chunks of ~100 lines, but from different locations in the file) * What led up to the situation? No idea. We did update to 4.92-7 from bpo before we saw the problem for the first time. The server had ~100 days of uptime and is processing a few thousand emails every day, but only a handfull seem to be affected by this. We haven't been able to reproduce the problem yet. We can see the incoming email in our logs Example: 2019-06-13 17:55:22 1hbS4P-0004q8-LL <= linux-usb-ow...@vger.kernel.org \ H=vger.kernel.org [209.132.180.67] P=esmtp K S=9996 DKIM=linaro.org [...] The first error message is logged with the same timestamp: 2019-06-13 17:55:22 1hbS4P-0004q8-LL Format error in spool file 1hbS4P-0004q8-LL-H: size=9934 If anyone has seen something like this before, I'd really appreceate a pointer to some more information :-) With kind regards, Bjørn *** End of the template - remove these template lines *** -- System Information: Debian Release: 9.9 APT prefers stable-updates APT policy: (990, 'stable-updates'), (990, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.19.0-0.bpo.4-amd64 (SMP w/8 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system)