Re: Exim4 MTA CVEs assigned from ZDI

[Cory McIntire <cory.mcintire () webpros com>]

Just to be clear, Exim did release 4.96.1 with 3 of the 6 patched:

https://git.exim.org/exim.git/blob/b9e0b12d9b665bbff996382264d4ba97d1a61efd:/doc/doc-txt/ChangeLog


Regards,
Cory McIntire | Lead – cPanel Application Security Team | Release Manager – EasyApache
cory.mcintire () webpros com<mailto:cory.mcintire () webpros com> | cPanel – a webpros company




From: Salvatore Bonaccorso <salvatore.bonaccorso () gmail com> on behalf of Salvatore Bonaccorso <carnil () debian org>
Date: Thursday, October 5, 2023 at 14:13
To: zdi () trendmicro com <zdi () trendmicro com>
Cc: oss-security () lists openwall com <oss-security () lists openwall com>, Solar Designer <solar () openwall com>
Subject: Re: [oss-security] Exim4 MTA CVEs assigned from ZDI
Hi ZDI team,

I do not want to land between fronts but here is my understanding:

On Thu, Oct 05, 2023 at 05:40:58PM +0000, zdi () trendmicro com wrote:
> Apologies, We have not received any notifications from the
> developers that these issues have been patched. We will be happy to
> update our advisories once they do so.

So this feels like a locked situation. One one side I read from Exim
maintainers, that there was not much information provided to actually
determine where the issue is, neither if it is specific to Exim's use
of libspf2 or if the issue is actually in libspf2.

On the ZDI side I read that advisories will be updated once ZDI gets
notification from the Exim developers that the issue is patched.

And on a third front, there is the libspf2 report at
https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fshevek%2Flibspf2%2Fpull%2F44&data=05%7C01%7Ccory.mcintire%40webpros.com%7Ca71a744a7ab24a5e023608dbc5d722f0%7Cf8497356a834406086b6d4b1d8059ee0%7C0%7C0%7C638321300025204208%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Sc%2Bxzp0WFVsWUshEHXSj60TaLK36D6Yfi9H6zRTUMMA%3D&reserved=0<https://github.com/shevek/libspf2/pull/44>
 which *might* be related,
but nobody can tell if it's the same as ZDI-23-1472.

Again, my interest is to see this situation unblocked, and just asking
as a member of a distribution which might have affected packages and
for which we would want to deploy updates covering the fixes.

Thanks in advance,

Regards,
Salvatore