Re: [exim-dev] Taint Issues: 4.93/FreeBSD port

2020-02-20 Thread Jeremy Harris via Exim-dev
On 20/02/2020 17:31, Larry Rosenman via Exim-dev wrote:
> I tried to upgrade to 4.93 today, and had to roll back to 4.92.3.

> Help?

exim-4.93+fixes branch
-- 
Cheers,
  Jeremy

-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim 
details at http://www.exim.org/ ##


[exim-dev] Taint Issues: 4.93/FreeBSD port

2020-02-20 Thread Larry Rosenman via Exim-dev

I tried to upgrade to 4.93 today, and had to roll back to 4.92.3.

I get:
[I] ➜ grep -i taint /var/log/maillog
<17>1 2020-02-20T10:38:44.854525-06:00 thebighonker.lerctr.org exim 
59285 - - [1\2] 1j4oqa-000FQD-Nw Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:38:44.889621-06:00 thebighonker.lerctr.org exim 
59224 - - 1j4oqa-000FPE-Nw attempt to expand tainted string '$1'
<21>1 2020-02-20T10:38:44.890149-06:00 thebighonker.lerctr.org exim 
59224 - - [1\52] 1j4oqa-000FPE-Nw H=malur.postgresql.org 
[2a02:16a8:dc51::56]:50652 I=[2001:470:1f0f:3ad:bb:dcff:fe50:d900]:25 
X=TLS1.2:ECDHE-RSA-AES256-SHA:256 CV=yes DN="/CN=lists.postgresql.org" 
F= temporarily 
rejected during MIME ACL checks: failed to expand ACL string 
"${lookup{${lc:${sg{$mime_filename}{^.+\\.([a-zA-Z0-9]+)\$}{\$1lsearch{/usr/local/etc/exim/checkfiles/bad-exts}{yes}{no}}": 
attempt to expand tainted string '$1'
<17>1 2020-02-20T10:38:44.973850-06:00 thebighonker.lerctr.org exim 
59226 - - [1\2] 1j4oqa-000FPG-Nw Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:38:47.929854-06:00 thebighonker.lerctr.org exim 
59345 - - [1\2] 1j4oqd-000FRB-R2 Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:38:48.027188-06:00 thebighonker.lerctr.org exim 
59346 - - [1\2] 1j4oqd-000FRC-R2 Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:38:54.276084-06:00 thebighonker.lerctr.org exim 
59437 - - [1\2] 1j4oqk-000FSf-5I Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:38:55.233514-06:00 thebighonker.lerctr.org exim 
59440 - - [1\2] 1j4oql-000FSi-1N Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:38:56.331072-06:00 thebighonker.lerctr.org exim 
59482 - - [1\2] 1j4oqm-000FTO-7i Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:38:57.252803-06:00 thebighonker.lerctr.org exim 
59525 - - [1\2] 1j4oqn-000FU5-4V Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:38:57.583361-06:00 thebighonker.lerctr.org exim 
59347 - - 1j4oqn-000FRD-EY attempt to expand tainted string '$1'
<21>1 2020-02-20T10:38:57.583848-06:00 thebighonker.lerctr.org exim 
59347 - - [1\52] 1j4oqn-000FRD-EY H=malur.postgresql.org 
[217.196.149.56]:53230 I=[192.147.25.65]:25 
X=TLS1.2:ECDHE-RSA-AES256-SHA:256 CV=yes DN="/CN=lists.postgresql.org" 
F= temporarily 
rejected during MIME ACL checks: failed to expand ACL string 
"${lookup{${lc:${sg{$mime_filename}{^.+\\.([a-zA-Z0-9]+)\$}{\$1lsearch{/usr/local/etc/exim/checkfiles/bad-exts}{yes}{no}}": 
attempt to expand tainted string '$1'
<17>1 2020-02-20T10:40:02.858804-06:00 thebighonker.lerctr.org exim 
59708 - - [1\2] 1j4orq-000FX2-FA Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:40:04.243293-06:00 thebighonker.lerctr.org exim 
59794 - - [1\2] 1j4ors-000FYQ-1m Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:40:05.443663-06:00 thebighonker.lerctr.org exim 
59796 - - [1\2] 1j4ort-000FYS-7D Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:40:05.521456-06:00 thebighonker.lerctr.org exim 
59797 - - [1\2] 1j4ort-000FYT-DD Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:40:06.318268-06:00 thebighonker.lerctr.org exim 
59807 - - [1\2] 1j4oru-000FYd-7N Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:50:25.379393-06:00 thebighonker.lerctr.org exim 
61381 - - [1\2] 1j4p1t-000Fy1-6l Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:50:54.614045-06:00 thebighonker.lerctr.org exim 
61469 - - [1\2] 1j4p2M-000FzR-D7 Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T10:51:23.429945-06:00 thebighonker.lerctr.org exim 
61481 - - [1\2] 1j4p2p-000Fzd-5G Taint mismatch, Ustrncpy: ip_unixsocket 
518
<17>1 2020-02-20T11:03:16.207210-06:00 thebighonker.lerctr.org exim 
64926 - - 1j4pEH-000GtC-Sf attempt to expand tainted string '$1'
<21>1 2020-02-20T11:03:16.207829-06:00 thebighonker.lerctr.org exim 
64926 - - [1\115] 1j4pEH-000GtC-Sf H=mail-qv1-xf2f.google.com 
[2607:f8b0:4864:20::f2f]:44553 
I=[2001:470:1f0f:3ad:bb:dcff:fe50:d900]:25 
X=TLS1.3:TLS_AES_128_GCM_SHA256:128 CV=yes 
DN="/C=US/ST=California/L=Mountain View/O=Google LLC/CN=smtp.gmail.com" 
SNI="thebighonker.lerctr.org" 
F= temporarily rejected 
during MIME ACL checks: failed to expand ACL string 
"${lookup{${lc:${sg{$mime_filename}{^.+\\.([a-zA-Z0-9]+)\$}{\$1lsearch{/usr/local/etc/exim/checkfiles/bad-exts}{yes}{no}}": 
attempt to expand tainted string '$1'
<17>1 2020-02-20T11:08:23.275666-06:00 thebighonker.lerctr.org exim 
66252 - - 1j4pJH-000HEa-3y attempt to expand tainted string '$1'
<21>1 2020-02-20T11:08:23.276207-06:00 thebighonker.lerctr.org exim 
66252 - - [1\52] 1j4pJH-000HEa-3y H=malur.postgresql.org 
[2a02:16a8:dc51::56]:39768 I=[2001:470:1f0f:3ad:bb:dcff:fe50:d900]:25 
X=TLS1.2:ECDHE-RSA-AES256-SHA:256 CV=yes DN="/CN=lists.postgresql.org" 
F= temporarily 
rejected during MIME ACL checks: failed to expand ACL string