Re: Exim4 MTA CVEs assigned from ZDI

[Salvatore Bonaccorso <carnil () debian org>]

Hi ZDI team,

I do not want to land between fronts but here is my understanding:

On Thu, Oct 05, 2023 at 05:40:58PM +0000, zdi () trendmicro com wrote:
> Apologies, We have not received any notifications from the
> developers that these issues have been patched. We will be happy to
> update our advisories once they do so.

So this feels like a locked situation. One one side I read from Exim
maintainers, that there was not much information provided to actually
determine where the issue is, neither if it is specific to Exim's use
of libspf2 or if the issue is actually in libspf2.

On the ZDI side I read that advisories will be updated once ZDI gets
notification from the Exim developers that the issue is patched.

And on a third front, there is the libspf2 report at
https://github.com/shevek/libspf2/pull/44 which *might* be related,
but nobody can tell if it's the same as ZDI-23-1472. 

Again, my interest is to see this situation unblocked, and just asking
as a member of a distribution which might have affected packages and
for which we would want to deploy updates covering the fixes.

Thanks in advance,

Regards,
Salvatore