* bug#66304: exim vulnearable to CVE-2023-42115 et al
@ 2023-10-02 10:35 Wilko Meyer
2023-10-05 15:25 ` bug#66304: [PATCH] gnu: exim: Update to 4.96.1 Wilko Meyer
2023-10-06 21:14 ` bug#66304: exim vulnearable to CVE-2023-42115 et al John Kehayias via Bug reports for GNU Guix
0 siblings, 2 replies; 3+ messages in thread
From: Wilko Meyer @ 2023-10-02 10:35 UTC (permalink / raw)
To: 66304
Hi Guix,
Exim currently has unpatched vulnearabilities regarding its EXTERNAL
Auth driver as well as its SPA/NTLM authenticator.
According to the project[0] prospective fixes seem to be around the
corner. We should probably bump the Exim version we ship to a
non-vulnearable version as soon as one is available.
[0]: https://www.exim.org/static/doc/security/CVE-2023-zdi.txt
--
Kind regards,
Wilko Meyer
w@wmeyer.eu
^ permalink raw reply [flat|nested] 3+ messages in thread
* bug#66304: [PATCH] gnu: exim: Update to 4.96.1
2023-10-02 10:35 bug#66304: exim vulnearable to CVE-2023-42115 et al Wilko Meyer
@ 2023-10-05 15:25 ` Wilko Meyer
2023-10-06 21:14 ` bug#66304: exim vulnearable to CVE-2023-42115 et al John Kehayias via Bug reports for GNU Guix
1 sibling, 0 replies; 3+ messages in thread
From: Wilko Meyer @ 2023-10-05 15:25 UTC (permalink / raw)
To: 66304; +Cc: Wilko Meyer
* gnu/packages/mail.scm (exim): Update to 4.96.1.
---
gnu/packages/mail.scm | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/gnu/packages/mail.scm b/gnu/packages/mail.scm
index 72d971eb77..e6923627f4 100644
--- a/gnu/packages/mail.scm
+++ b/gnu/packages/mail.scm
@@ -52,6 +52,7 @@
;;; Copyright © 2022 jgart <jgart@dismail.de>
;;; Copyright © 2022 ( <paren@disroot.org>
;;; Copyright © 2023 Timo Wilken <guix@twilken.net>
+;;; Copyright © 2023 Wilko Meyer <w@wmeyer.eu>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -1895,7 +1896,7 @@ (define-public msmtp
(define-public exim
(package
(name "exim")
- (version "4.96")
+ (version "4.96.1")
(source
(origin
(method url-fetch)
@@ -1909,7 +1910,7 @@ (define-public exim
(string-append "https://ftp.exim.org/pub/exim/exim4/old/"
file-name))))
(sha256
- (base32 "18ziihkpa23lybm7m2l9wp2farxw0bd5ng7xm9ylgcrfgf95d6i9"))))
+ (base32 "0g83cxkq3znh5b3r2a3990qxysw7d2l71jwcxaxzvq8pqdahgb4k"))))
(build-system gnu-build-system)
(arguments
(list #:phases
base-commit: ad5e4fe54a66c725dc03dedebf8e5c65723ccb74
prerequisite-patch-id: 5bde835de1e0f7e9cd752986da0585463713d745
prerequisite-patch-id: cda50d13de497f5c74c87b2def4ae6a7d5807305
prerequisite-patch-id: 7024afc52961b5947429f925c55265f29607c801
prerequisite-patch-id: 10a4f92340880065a5210c983cc878c98c075855
prerequisite-patch-id: e6610085f98fb881bada0bb27b59def23c3d7cc3
--
2.41.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* bug#66304: exim vulnearable to CVE-2023-42115 et al
2023-10-02 10:35 bug#66304: exim vulnearable to CVE-2023-42115 et al Wilko Meyer
2023-10-05 15:25 ` bug#66304: [PATCH] gnu: exim: Update to 4.96.1 Wilko Meyer
@ 2023-10-06 21:14 ` John Kehayias via Bug reports for GNU Guix
1 sibling, 0 replies; 3+ messages in thread
From: John Kehayias via Bug reports for GNU Guix @ 2023-10-06 21:14 UTC (permalink / raw)
To: Wilko Meyer; +Cc: 66304-done
Hello,
On Thu, Oct 05, 2023 at 05:25 PM, Wilko Meyer wrote:
> * gnu/packages/mail.scm (exim): Update to 4.96.1.
> ---
> gnu/packages/mail.scm | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/gnu/packages/mail.scm b/gnu/packages/mail.scm
> index 72d971eb77..e6923627f4 100644
> --- a/gnu/packages/mail.scm
> +++ b/gnu/packages/mail.scm
> @@ -52,6 +52,7 @@
> ;;; Copyright © 2022 jgart <jgart@dismail.de>
> ;;; Copyright © 2022 ( <paren@disroot.org>
> ;;; Copyright © 2023 Timo Wilken <guix@twilken.net>
> +;;; Copyright © 2023 Wilko Meyer <w@wmeyer.eu>
> ;;;
> ;;; This file is part of GNU Guix.
> ;;;
> @@ -1895,7 +1896,7 @@ (define-public msmtp
> (define-public exim
> (package
> (name "exim")
> - (version "4.96")
> + (version "4.96.1")
> (source
> (origin
> (method url-fetch)
> @@ -1909,7 +1910,7 @@ (define-public exim
> (string-append "https://ftp.exim.org/pub/exim/exim4/old/"
> file-name))))
> (sha256
> - (base32 "18ziihkpa23lybm7m2l9wp2farxw0bd5ng7xm9ylgcrfgf95d6i9"))))
> + (base32 "0g83cxkq3znh5b3r2a3990qxysw7d2l71jwcxaxzvq8pqdahgb4k"))))
> (build-system gnu-build-system)
> (arguments
> (list #:phases
>
> base-commit: ad5e4fe54a66c725dc03dedebf8e5c65723ccb74
> prerequisite-patch-id: 5bde835de1e0f7e9cd752986da0585463713d745
> prerequisite-patch-id: cda50d13de497f5c74c87b2def4ae6a7d5807305
> prerequisite-patch-id: 7024afc52961b5947429f925c55265f29607c801
> prerequisite-patch-id: 10a4f92340880065a5210c983cc878c98c075855
> prerequisite-patch-id: e6610085f98fb881bada0bb27b59def23c3d7cc3
Thanks for the patch and quickly noticing the security issues!
Pushed as add2a22ad7bcca2521432e3f486460138401d5a5 with some added
detail to the commit message. I tested that exim and a dependent builds.
John
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-10-06 21:14 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-10-02 10:35 bug#66304: exim vulnearable to CVE-2023-42115 et al Wilko Meyer
2023-10-05 15:25 ` bug#66304: [PATCH] gnu: exim: Update to 4.96.1 Wilko Meyer
2023-10-06 21:14 ` bug#66304: exim vulnearable to CVE-2023-42115 et al John Kehayias via Bug reports for GNU Guix
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).