oss-security - Re: Exim4 MTA CVEs assigned from ZDI

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 5 Oct 2023 20:44:39 +0000
From: Cory McIntire <cory.mcintire@...pros.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
	"zdi@...ndmicro.com" <zdi@...ndmicro.com>
CC: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>, Solar
 Designer <solar@...nwall.com>
Subject: Re: Exim4 MTA CVEs assigned from ZDI

Just to be clear, Exim did release 4.96.1 with 3 of the 6 patched:

https://git.exim.org/exim.git/blob/b9e0b12d9b665bbff996382264d4ba97d1a61efd:/doc/doc-txt/ChangeLog

Regards,
Cory McIntire | Lead – cPanel Application Security Team | Release Manager – EasyApache
cory.mcintire@...pros.com<mailto:cory.mcintire@...pros.com> | cPanel – a webpros company

From: Salvatore Bonaccorso <salvatore.bonaccorso@...il.com> on behalf of Salvatore Bonaccorso <carnil@...ian.org>
Date: Thursday, October 5, 2023 at 14:13
To: zdi@...ndmicro.com <zdi@...ndmicro.com>
Cc: oss-security@...ts.openwall.com <oss-security@...ts.openwall.com>, Solar Designer <solar@...nwall.com>
Subject: Re: [oss-security] Exim4 MTA CVEs assigned from ZDI
Hi ZDI team,

I do not want to land between fronts but here is my understanding:

On Thu, Oct 05, 2023 at 05:40:58PM +0000, zdi@...ndmicro.com wrote:
> Apologies, We have not received any notifications from the
> developers that these issues have been patched. We will be happy to
> update our advisories once they do so.

So this feels like a locked situation. One one side I read from Exim
maintainers, that there was not much information provided to actually
determine where the issue is, neither if it is specific to Exim's use
of libspf2 or if the issue is actually in libspf2.

On the ZDI side I read that advisories will be updated once ZDI gets
notification from the Exim developers that the issue is patched.

And on a third front, there is the libspf2 report at
https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fshevek%2Flibspf2%2Fpull%2F44&data=05%7C01%7Ccory.mcintire%40webpros.com%7Ca71a744a7ab24a5e023608dbc5d722f0%7Cf8497356a834406086b6d4b1d8059ee0%7C0%7C0%7C638321300025204208%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Sc%2Bxzp0WFVsWUshEHXSj60TaLK36D6Yfi9H6zRTUMMA%3D&reserved=0<https://github.com/shevek/libspf2/pull/44> which *might* be related,
but nobody can tell if it's the same as ZDI-23-1472.

Again, my interest is to see this situation unblocked, and just asking
as a member of a distribution which might have affected packages and
for which we would want to deploy updates covering the fixes.

Thanks in advance,

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.