Exim vulnerabilities

[sergioadofaci]

Hello!

I would really appreciate to know when should we expect to see the exim package be updated to fix the followings critical and high CVEs:

CVE-2023-42114
CVE-2023-42115
CVE-2023-42116

More info:

https://seclists.org/oss-sec/2023/q3/254

Thanks!

[JohnMertz]

Hello,

We are aware of these issues and the 3 that are not yet fixed. I'm reading through the latest communications on the mailing lists and forums for news on the three unpatched issues. Given that our automatic update cycle is runs late in the evening, once-per-day, I'm hoping that we can push out one fully patched version this evening rather than two half-patched versions a day or two apart. If I see nothing that indicates that further patches are forthcoming, I'll publish the half-patched version before the end of my workday (North American Mountain Time). I'm already compiling the version with these 3 patches as I type this...

[sergioadofaci]

Thank you for the update!, great work guys.

[JohnMertz]

If you are interested in testing the version with the 3 existing patches, I uploaded it here:

https://cdnpush.s3.us-east-2.stackpathstorage.com/mc-exim-4.96.1_amd64.deb

You should be able to download it with wget then install with dpkg -i mc-exim-4.96.1_amd64.deb and restart all stages for i in 4 2 1; do /usr/mailcleaner/etc/init.d/exim_stage${i} restart; done.

Note: At the moment I've only installed it on my personal MailCleaner server, so it is far from being fully tested. It doesn't contain many other changes since the 4.96 release other than the vulnerability mitigations; just a couple of bug fixes. We appreciate any feedback if you do want to give it a try. If you encounter any issues, you can rollback with apt install mc-exim=4.96 -y --force-yes.

[JohnMertz]

Given that there were no follow-up commits, I have published the 4.96.1 deb listed above to the repositories and merged the update script in Updater4MC to install it. This addresses the 3 CVEs of primary concern, but we are awaiting news from upstream on the others.

[sergioadofaci]

I've updated exim and everything is working fine, no issues whatsoever.