[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <0D1F6213-D667-4E9C-B541-52E52429B756@graemef.net>
Date: Wed, 10 Aug 2022 15:44:25 +0100
From: Graeme Fowler <graeme+osssec@...emef.net>
To: oss-security@...ts.openwall.com
Subject: Re: [Exim-Security] Exim < 4.95 heap overflow
On 7 Aug 2022, at 16:39, Roxana Bradescu via Security <security@...m.org> wrote:
> Adding the Exim security folks to this thread to shed some light on the original report and CVE discussion.
Responding separately to each list...
The Exim developers don't use github to track bugs, there is a bugzilla instance used for that which is detailed on the Github Readme.pod page.
This issue (and others) weren't "silently fixed"; they were openly tracked in Bugzilla, and an example is here:
https://bugs.exim.org/show_bug.cgi?id=2747 (fixing the observed issue in this thread).
The pages detailing CVEs were regularly updated by a developer who is no longer involved. These have not been updated since 2019 as you observe, yet there have been 23 CVEs addressed by the developers. These are fairly easy to find using your favourite CVE tracker.
The development process - excepting times when a CVE has been allocated - is pretty open and easy to find, as all the commits are in the Git repo and bugzilla updates are mirrored into the exim-dev mailing list, often including the commit also.
Regards
Graeme
(wearing my exim mailing list admin hat)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
