Cannot specify server certificate hostname verification whitelist

Do you know if a CVE has been assigned for this issue?

Thanks

We sent email to <email address hidden> and got the following response, but we don't agree that this is an intentionally made.

This patch appears to be outside the scope of CVE. For issues of this type, the scope of CVE is limited to unintentional implementation mistakes. Here, the vendor intentionally did not do a hostname check because (quoting http://bugs.exim.org/show_bug.cgi?id=1479#c2) "Exim is an MTA, there has been no sane approach to determining a hostname suitable for verification of certificate identity." The vendor went on to implement a useful security enhancement in response to your report.
This is a very good outcome, but security enhancements are not assigned CVE-IDs.

This seems to be enabled by default in 4.86RC.

http://git.exim.org/exim.git/commit/01a4a5c5cbaa40ca618d3e233991ce183b551477

I just looked into this, prompted by Chuck Peters on the ubuntu-server list.

It seems to me that this is a security-related feature made upstream in a newer release of exim4. To use it, every individual sysadmin would need to manually configure the tls_verify_cert_hostnames setting to a list of hostnames to use for stricter certificate checking when connecting to those particular hosts. Is this understanding accurate?

Chuck requested a backport to Trusty on the list. I think feature would have limited value in an update automatically recommended to all users (such as an SRU or security update), since most users would not be aware of the feature in order to enable it. And the feature is of limited use on the wider Internet anyway. We'd only be enabling the feature for a very small proportion of "opt-in" users because of the configuration requirement, for whom I suggest that the backports repository or moving to a newer (yet to be released) Ubuntu release would be more suitable. So I'm in favour of merging 4.86 into the development release when it is available, but am not convinced that this is suitable in an update that would be automatically recommended to all users such as through trusty-updates.

I welcome discussion on this though. I'm particularly interested in the security team's opinion.