Re: CVE-2026-45185 - need more information and clarifications

On 2026-05-17 Andreas Metzler <[email protected]> wrote:
> On 2026-05-17 Fabio Muzzi via Exim-users <[email protected]> wrote:
[...]
> > Thanks, I have checked and my unsupported versions are in Debian 9 and
> > 10 (11 12 and 13 have patches ready). In Debian 9 and 10 chunking
> > should be there (it was introduced in Exim 4.88) but still it's not
> > advertised to remote hosts even without explicitly disabling it. I
> > disabled it anyway to be sure.
[...]
> I had patched Debian's exim up from 4.88-5 to 4.89-4 to not enable
> BDAT by default:
[...]
> That's why the Debian packages for stretch/9 (4.89-2) and buster/10
> (4.92-8) do no advertise/use CHUNKING by default.

Obviously there is a thinko here. I have explained stretch/9, but
buster/10 should advertise CHUNKING.

cu Andreas
-- 
"You people are noisy," Nia said.
I made the gesture of agreement.

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki