#66304 - exim vulnearable to CVE-2023-42115 et al

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #15 received at 66304-done@debbugs.gnu.org (full text, mbox, reply):

Received: (at 66304-done) by debbugs.gnu.org; 6 Oct 2023 21:14:42 +0000
From debbugs-submit-bounces@debbugs.gnu.org Fri Oct 06 17:14:42 2023
Received: from localhost ([127.0.0.1]:52786 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1qos9h-0000jE-S2
	for submit@debbugs.gnu.org; Fri, 06 Oct 2023 17:14:42 -0400
Received: from mail-40131.protonmail.ch ([185.70.40.131]:12813)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <john.kehayias@protonmail.com>) id 1qos9e-0000ix-Ih
 for 66304-done@debbugs.gnu.org; Fri, 06 Oct 2023 17:14:40 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com;
 s=protonmail3; t=1696626852; x=1696886052;
 bh=yR1kXMeVdZ46EY3QNg6Hx44qdg+bZDdwP0dZW0U9NHw=;
 h=Date:To:From:Cc:Subject:Message-ID:Feedback-ID:From:To:Cc:Date:
 Subject:Reply-To:Feedback-ID:Message-ID:BIMI-Selector;
 b=sgQ6jrakKe9qTaCvxC7dZSqZRO7SXouhEq4vqk1iHepX7Qsje5m2AF6Sjm3gBaW43
 JoMgIibFJWU9BzCzGv/U8InQYrXrLQ5Y7ZcLuc3a0h6Gy0sAwgNrjYbBph97atOflt
 VCfLqbU7OMTlJynht5uos2vlygcvBHNeetfdMEP7Zfr0jqgIFUMd9vYH7hG8A8ryfp
 sTQogHgNNLLcDTcLo3Alm9JtsdEAmTdJVsJ35STG9EoLSSXkVvUx6hleGkoMKY3uYv
 k5JqYx0sf1QAKTiiYayF+A7LgemPoKI8JExHnBupN+hut6nHNYcqlMAKG83zvc35yl
 rRLX4Tf7QK2mg==
Date: Fri, 06 Oct 2023 21:14:05 +0000
To: Wilko Meyer <w@wmeyer.eu>
From: John Kehayias <john.kehayias@protonmail.com>
Subject: Re: bug#66304: exim vulnearable to CVE-2023-42115 et al
Message-ID: <87wmvz8ne9.fsf_-_@protonmail.com>
Feedback-ID: 7805494:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 66304-done
Cc: 66304-done@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Hello,

On Thu, Oct 05, 2023 at 05:25 PM, Wilko Meyer wrote:

>     * gnu/packages/mail.scm (exim): Update to 4.96.1.
> ---
>  gnu/packages/mail.scm | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/gnu/packages/mail.scm b/gnu/packages/mail.scm
> index 72d971eb77..e6923627f4 100644
> --- a/gnu/packages/mail.scm
> +++ b/gnu/packages/mail.scm
> @@ -52,6 +52,7 @@
>  ;;; Copyright © 2022 jgart <jgart@dismail.de>
>  ;;; Copyright © 2022 ( <paren@disroot.org>
>  ;;; Copyright © 2023 Timo Wilken <guix@twilken.net>
> +;;; Copyright © 2023 Wilko Meyer <w@wmeyer.eu>
>  ;;;
>  ;;; This file is part of GNU Guix.
>  ;;;
> @@ -1895,7 +1896,7 @@ (define-public msmtp
>  (define-public exim
>    (package
>      (name "exim")
> -    (version "4.96")
> +    (version "4.96.1")
>      (source
>       (origin
>         (method url-fetch)
> @@ -1909,7 +1910,7 @@ (define-public exim
>                      (string-append "https://ftp.exim.org/pub/exim/exim4/old/"
>                                     file-name))))
>         (sha256
> -        (base32 "18ziihkpa23lybm7m2l9wp2farxw0bd5ng7xm9ylgcrfgf95d6i9"))))
> +        (base32 "0g83cxkq3znh5b3r2a3990qxysw7d2l71jwcxaxzvq8pqdahgb4k"))))
>      (build-system gnu-build-system)
>      (arguments
>       (list #:phases
>
> base-commit: ad5e4fe54a66c725dc03dedebf8e5c65723ccb74
> prerequisite-patch-id: 5bde835de1e0f7e9cd752986da0585463713d745
> prerequisite-patch-id: cda50d13de497f5c74c87b2def4ae6a7d5807305
> prerequisite-patch-id: 7024afc52961b5947429f925c55265f29607c801
> prerequisite-patch-id: 10a4f92340880065a5210c983cc878c98c075855
> prerequisite-patch-id: e6610085f98fb881bada0bb27b59def23c3d7cc3

Thanks for the patch and quickly noticing the security issues!

Pushed as add2a22ad7bcca2521432e3f486460138401d5a5 with some added
detail to the commit message. I tested that exim and a dependent builds.

John

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 01:01:37 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#66304 exim vulnearable to CVE-2023-42115 et al