[exim] Re: Wait for fix to appear in distros?

2023-10-03 Thread Paul Vinkenoog via Exim-users
Sorry, this somehow got sent before I finished it. Cyborg wrote: > > I'm wondering now: should I wait a little more (risky?) or replace my > > version (from Almalinux 9) with the fixed version that was brought out > > yesterday? > > Isn't it a fork of Redhat? Have you checked the Fedora Repos, t

[exim] Re: Wait for fix to appear in distros?

2023-10-03 Thread Paul Vinkenoog via Exim-users
On Tue, 3 Oct 2023 18:26:19 +0200, you wrote: Cyborg wrote: > > I'm wondering now: should I wait a little more (risky?) or replace my > > version (from Almalinux 9) with the fixed version that was brought out > > yesterday? > > > > Isn't it a fork of Redhat? Have you checked the Fedora Repos, th

[exim] Re: Wait for fix to appear in distros?

2023-10-03 Thread Paul Vinkenoog via Exim-users
Jeremy Harris wrote: > On 03/10/2023 12:04, Paul Vinkenoog via Exim-users wrote: > > BTW, none of my installations advertise the AUTH command to > > anyone (and they refuse it when issued). Does that mean I'm > > relatively safe? > > That covers CVE-2023-42114 & CVE-2023-42115 only. That's right

[exim] Re: Mitigation statement for CVE-2023-42119

2023-10-03 Thread Slavko via Exim-users
Dňa 3. októbra 2023 15:48:01 UTC používateľ Johnnie W Adams via Exim-users napísal: >Hi, folks, > > What I take from this mitigation statement--Use a trustworthy DNS >resolver which is able to validate the data according to the DNS record >types--is that if our DNS service is solid, we are no

[exim] Re: Mitigation statement for CVE-2023-42119

2023-10-03 Thread Jeremy Harris via Exim-users
On 03/10/2023 16:48, Johnnie W Adams via Exim-users wrote: What I take from this mitigation statement--Use a trustworthy DNS resolver which is able to validate the data according to the DNS record types--is that if our DNS service is solid, we are not vulnerable. Is this accurate, or am I o

[exim] Re: Wait for fix to appear in distros?

2023-10-03 Thread Cyborg via Exim-users
Am 03.10.23 um 13:04 schrieb Paul Vinkenoog via Exim-users: But so far, nothing has shown up. I'm wondering now: should I wait a little more (risky?) or replace my version (from Almalinux 9) with the fixed version that was brought out yesterday? Isn't it a fork of Redhat? Have you checked th

[exim] Re: Wait for fix to appear in distros?

2023-10-03 Thread Jeremy Harris via Exim-users
On 03/10/2023 12:04, Paul Vinkenoog via Exim-users wrote: BTW, none of my installations advertise the AUTH command to anyone (and they refuse it when issued). Does that mean I'm relatively safe? That covers CVE-2023-42114 & CVE-2023-42115 only. -- Cheers, Jeremy -- ## subscription configura

[exim] Re: Wait for fix to appear in distros?

2023-10-03 Thread Slavko via Exim-users
Dňa 3. októbra 2023 11:04:28 UTC používateľ Paul Vinkenoog via Exim-users napísal: >I'm running exim on a number of servers and after the news yesterday >I expected to see the fixed version appear soon in the various repos. On debian i updated my mail systems yesterday (2. Oct) at ~19:00 CEST a

[exim] Re: Mitigation statement for CVE-2023-42119

2023-10-03 Thread Kurt Jaeger via Exim-users
Hi! > What I take from this mitigation statement--Use a trustworthy DNS > resolver which is able to validate the data according to the DNS record > types--is that if our DNS service is solid, we are not vulnerable. Is this > accurate, or am I oversimplifying things? The mitigation statement f

[exim] Mitigation statement for CVE-2023-42119

2023-10-03 Thread Johnnie W Adams via Exim-users
Hi, folks, What I take from this mitigation statement--Use a trustworthy DNS resolver which is able to validate the data according to the DNS record types--is that if our DNS service is solid, we are not vulnerable. Is this accurate, or am I oversimplifying things? The mitigation statement fr

[exim] Re: Exim Zero Day?

2023-10-03 Thread * Neustradamus * via Exim-users
Hello all, It is possible to update GitHub? - https://github.com/Exim/exim Releases 2 4.95 (Latest) on Oct 8, 2021 + 1 release When I look https://github.com/Exim/exim/releases : Latest builds are: - 4.95 (2021-10-08): https://github.com/Exim/exim/releases/tag/exim-4.95 - Stabilisation (Bad name

[exim] Wait for fix to appear in distros?

2023-10-03 Thread Paul Vinkenoog via Exim-users
Hello all, I'm running exim on a number of servers and after the news yesterday I expected to see the fixed version appear soon in the various repos. But so far, nothing has shown up. I'm wondering now: should I wait a little more (risky?) or replace my version (from Almalinux 9) with the fixed

[exim] Re: Exim Zero Day?

2023-10-03 Thread Heiko Schlittermann via Exim-users
* Neustradamus * (Di 03 Okt 2023 12:57:35 CEST): > It is possible to update GitHub? > - https://github.com/Exim/exim > Maybe the solution is to remove the cited releases. Done so and put there 4.91.1. Will be forgotten next time too, I'm afraid. Wo do not activly maintain the Github copy. -- Hei

[exim] Re: Exim Zero Day?

2023-10-03 Thread Heiko Schlittermann via Exim-users
Cyborg via Exim-users (Di 03 Okt 2023 09:52:24 CEST): … I'm not repeating Cyborg here, but he's right. Thank you. And I'd like to stress that we do *not* think "ha, it is open source, they may help themselves.". But, sometimes we might be pissed if the questions are too demanding or even turn i

[exim] Re: Exim Zero Day?

2023-10-03 Thread Cyborg via Exim-users
Am 02.10.23 um 21:53 schrieb Christof Meerwald via Exim-users: But my understanding here is that fixes were actually already done in May 2023, see https://git.exim.org/exim.git/commit/7bb5bc2c6592e062bf0b514cc71afd2d93e2e0dd Auths: fix possible OOB write in external authenticator. Bug 2999 autho