Re: CVE-2026-45185 - need more information and clarifications
Jeremy Harris via Exim-users <[email protected]> Sat, 16 May 2026 15:17:16 +0200
| Newsgroups | gmane.mail.exim.user |
|---|---|
| Message-ID | <[email protected]> |
On 14 May 2026 16:28:58 CEST, Fabio Muzzi via Exim-users <[email protected]> wrote: > "Affects: Exim 4.97 up to and including 4.99.2" Does this mean that prior to 4.97 the bug was not there, or does this mean that no one cared to look for it, but the bug is in fact there since forever? > We've not looked, not having the resouces for infinite back-version support. You should probably assume since the intro of chunking. >Second, the mitigation: setting "chunking_advertise_hosts=" to a null list, thus disabling chunking support for all remote hosts is enough to mitigate the risk until I can upgrade the servers? Yes. -- Cheers, Jeremy -- ## subscription configuration (requires account): ## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/ ## unsubscribe (doesn't require an account): ## [email protected] ## Exim details at https://www.exim.org/ ## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki