Re: CVE-2026-45185 - need more information and clarifications

On 2026-05-17 Fabio Muzzi via Exim-users <[email protected]> wrote:
> On 16/05/2026 15.17, Jeremy Harris via Exim-users wrote:

> > > "Affects: Exim 4.97 up to and including 4.99.2"  Does this mean that prior to 4.97 the bug was not there, or does this mean that no one cared to look for it, but the bug is in fact there since forever?
> > We've not looked, not having the resouces for infinite back-version support. You should probably assume since the intro of chunking.

> Thanks, I have checked and my unsupported versions are in Debian 9 and
> 10 (11 12 and 13 have patches ready). In Debian 9 and 10 chunking
> should be there (it was introduced in Exim 4.88) but still it's not
> advertised to remote hosts even without explicitly disabling it. I
> disabled it anyway to be sure.

Hello,

Bdat/chunking was added in 4.88. Debian jessie/8 predates that (4.84).
I had patched Debian's exim up from 4.88-5 to 4.89-4 to not enable
BDAT by default:

* 78_Disable-chunking-BDAT-by-default.patch: Change default value of main
  option chunking_advertise_hosts and smtp transport option
  hosts_try_chunking from "*" to empty.
  This is a Debian specific change, we are right before the freeze and BDAT
  needs a little time.

That's why the Debian packages for stretch/9 (4.89-2) and buster/10
(4.92-8) do no advertise/use CHUNKING by default.

cu Andreas

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki