Bug#1148506: exim4: CVE-2026-94054 CVE-2026-94055 CVE-2026-94056 CVE-2026-94057

[Andreas Metzler]

On 2026-09-24 Salvatore Bonaccorso <carnil at debian.org> wrote:
> On Thu, Sep 24, 2026 at 09:59:32PM +0200, Salvatore Bonaccorso wrote:
> > On Thu, Sep 24, 2026 at 07:02:00PM +0200, Andreas Metzler wrote:
[...]
> > > the second one (CVE-2026-94055 / GnuTLS) only applies to versions >=
> > > 4.99, i.e. stable and earlier are fine. tls_early_banner was not
> > > available in earlier releases.
> > 
> > Alright, thanks will update the tracker.

> Hmm ist that correct? The upstream advisory say:

> - Exim versions from 4.98 up to and including 4.100 are affected.
> - The installation must be built with GnuTLS 3.6.4 or later, and configured
>    to accept TLS-on-connect.
> - The configuration must enable the tls_early_banner_hosts option
>    (a non-default setting).

Hello Salvatore,

I have asked upstream to confirm/reject this.
https://lists.exim.org/lurker/message/20260925.044831.5cb31b15.en.html

Propopsed patch attched.

cu Andreas
-- 
"You people are noisy," Nia said.
I made the gesture of agreement.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 4.98.2-1+deb13u5.proposed.diff
Type: text/x-diff
Size: 14667 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-exim4-maintainers/attachments/20260925/5303ffd4/attachment-0001.diff>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-exim4-maintainers/attachments/20260925/5303ffd4/attachment-0001.sig>