Re: CVE-2026-45185 - need more information and clarifications

--===============0667734431643422581==
Content-Type: multipart/signed; boundary="Sig_/GLhGmIdL/84MiYOIUQZ5W64";
 protocol="application/pgp-signature"; micalg=pgp-sha512

--Sig_/GLhGmIdL/84MiYOIUQZ5W64
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

On Sat, 16 May 2026 15:17:16 +0200, Jeremy Harris via Exim-users wrote:

>> Second, the mitigation: setting "chunking_advertise_hosts=3D" to a
>> null list, thus disabling chunking support for all remote hosts is
>> enough to mitigate the risk until I can upgrade the servers?
>=20
> Yes.

Turns out I was accidentally protected from this RCE thanks to
disabling chunking in my config 9 years ago due to a different RCE:

root@pierre:/opt/mta/exim/config# grep chunking_ad exim4.conf -B 1
# https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.html
chunking_advertise_hosts =3D=20

Think I'll leave that one disabled.

Thanks,

Mike

--=20
Mike Cardwell <[email protected]> ----- @grepular:matrix.org
https://www.linkedin.com/in/mikecardwell --- https://www.grepular.com
https://bsky.app/profile/grepular.com ----- @[email protected]
https://www.emailprivacytester.com ------ https://gitlab.com/grepular
https://www.parsemail.org --------- https://hub.docker.com/u/grepular

--Sig_/GLhGmIdL/84MiYOIUQZ5W64
Content-Type: application/pgp-signature
Content-Description: OpenPGP digital signature

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEWazVMy7edA17fJTj0V47FkDmu60FAmoInwgACgkQ0V47FkDm
u62ZmggAh2KfhdMZ25mZFJ1VUVqIALzde4jvEoiYAw5wgACHmQkkzemI9WmmzD7+
AcjksOM+reUJQLxuOdfymbARqEL+8Y97Njq2KXT0cVF06oY9u4vbqbsE775237xc
WW1hl2f2a0SBqUDYgOSuf1+MpTo4SZnQBLVv58AgV2+KBxRRgAlugje2226BtJN4
QUEOS4pZ6wB/elyZxLgX2pRenWvq3bcPVSixVver7z3pBSiWhUoGKQlBMsyFE/tZ
KcysL1BrAfVK2euaOJfLhRImONhsjW3+7fAKxxlrYqyqjOYEVnIF+8goAGzJESM8
N244akie3Gt76gNy8CsehX46ODo70w==
=1Av4
-----END PGP SIGNATURE-----

--Sig_/GLhGmIdL/84MiYOIUQZ5W64--

--===============0667734431643422581==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki

--===============0667734431643422581==--