[exim] tainted filname issue

2021-05-05 Thread Dan Egli via Exim-users
How that last message got encrypted, I don't know. But this should be an unencrypted copy. On 5/5/2021 4:04 AM, Heiko Schlittermann via Exim-users wrote: Dan Egli via Exim-users (Mi 05 Mai 2021 02:41:38 CEST): I just upgraded to 4.94.2, and most everything is working fine. But I'm getting

[exim] ...

2021-05-05 Thread Dan Egli via Exim-users
binT4DZGM1Tc0.bin Description: PGP/MIME version identification encrypted.asc Description: OpenPGP encrypted message -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/

[exim] Outgoing mail : how to remove tags/keywords from the subjet header ?

2021-05-05 Thread 32.yves.roux--- via Exim-users
Hello, we have a spam/virus filtering system that add spam score and other info with keywords at the beginning of the subject header to inform the end-user and help him write sort-rules in his mail-client. Example : {spam: 43} {newsletter} {SPF: pass} {DKIM: No signature}, etc... But when an

Re: [exim] tainted filname issue

2021-05-05 Thread Heiko Schlittermann via Exim-users
Dan Egli via Exim-users (Mi 05 Mai 2021 22:45:34 CEST): > and I THINK it's okay. Problem is that I'm encountering another issue that > prevents me from saying all is well. I have my updated exim binary as > exim_new and the updated config as exim_new.conf, but when I try to submit a > message

Re: [exim] tainted filname issue

2021-05-05 Thread Jeremy Harris via Exim-users
On 05/05/2021 21:45, Dan Egli via Exim-users wrote: 2021-05-05 14:35:29.708 cwd=/etc/exim 5 args: exim_new -d -bd -C exim_new.conf [much deleted for brevity] 15754 Calling SSL_read(0x5573489f8110, 0x5573489f99a0, 4096) 15758 postfork: daemon-accept-delivery 15758 exec /usr/sbin/exim -C

Re: [exim] tainted data issues

2021-05-05 Thread Victor Ustugov via Exim-users
Heiko Schlittermann via Exim-users wrote on 05.05.2021 23:48: > Victor Ustugov via Exim-users (Mi 05 Mai 2021 22:29:32 > CEST): git clone --branch exim-4.94.2+fixes https://github.com/Exim/exim.git >>> >>> Sorry my fault, far too many branches, merges, and tags during the >>> recent days.

Re: [exim] tainted data issues

2021-05-05 Thread Heiko Schlittermann via Exim-users
Victor Ustugov via Exim-users (Mi 05 Mai 2021 22:29:32 CEST): > >> git clone --branch exim-4.94.2+fixes https://github.com/Exim/exim.git > > > > Sorry my fault, far too many branches, merges, and tags during the > > recent days. Branch is exim-4.94.2+taintwarn, which includes the +fixes > > and

Re: [exim] tainted data issues

2021-05-05 Thread Victor Ustugov via Exim-users
Heiko Schlittermann via Exim-users wrote on 05.05.2021 21:36: > Victor Ustugov via Exim-users (Mi 05 Mai 2021 20:01:56 > CEST): >> Heiko Schlittermann via Exim-users wrote on 05.05.2021 19:11: >> >>> In case you didn't notice. We've added a new but already deprecated main >>> config option: >>>

Re: [exim] tainted data issues

2021-05-05 Thread Heiko Schlittermann via Exim-users
Victor Ustugov via Exim-users (Mi 05 Mai 2021 20:01:56 CEST): > Heiko Schlittermann via Exim-users wrote on 05.05.2021 19:11: > > > In case you didn't notice. We've added a new but already deprecated main > > config option: > > > > allow_insecure_tainted_data = yes > > > > For this

Re: [exim] Sqlite Lookup absolute filename (was Exim 4.94.2 - security update released)

2021-05-05 Thread Slawomir Dworaczek via Exim-users
Helo Thanks for response, I add CFLAGS += -std=gnu99 and LDFLAGS=-lrt to Makefile and build successfuly ! Regards - Original Message - From: "Victor Ustugov via Exim-users" To: "Victor Ustugov via Exim-users" Sent: Wednesday, May 5, 2021 6:50 PM Subject: Re: [exim] Sqlite Lookup

Re: [exim] tainted data issues

2021-05-05 Thread Sander Smeenk via Exim-users
Quoting Heiko Schlittermann via Exim-users (exim-users@exim.org): > In case you didn't notice. We've added a new but already deprecated main > config option: > allow_insecure_tainted_data = yes Yes, thanks for your hard work, Heiko!! I saw that option being discussed / added. It sure

Re: [exim] tainted data issues

2021-05-05 Thread Victor Ustugov via Exim-users
Heiko Schlittermann via Exim-users wrote on 05.05.2021 19:11: > In case you didn't notice. We've added a new but already deprecated main > config option: > > allow_insecure_tainted_data = yes > > For this option you need to get exim-4.94.2+fixes. This option isn't > part of 4.94.2!

Re: [exim] Sqlite Lookup absolute filename (was Exim 4.94.2 - security update released)

2021-05-05 Thread Victor Ustugov via Exim-users
Victor Ustugov via Exim-users wrote on 05.05.2021 17:14: > Heiko Schlittermann via Exim-users wrote on 05.05.2021 16:16: >> I'd just refuse to create a bloated 4.94+fixes, instead of releasing >> 4.95 as soon as possible. > > Yesterday I built exim 4.94.2 with adapted code from

Re: [exim] Error compile exim 4.94.2

2021-05-05 Thread Viktor Dukhovni via Exim-users
On Wed, May 05, 2021 at 06:04:11PM +0200, Sławomir Dworaczek via Exim-users wrote: > exim.o: In function `exim_gettime': > exim.c:(.text+0xfbe): undefined reference to `clock_gettime' > exim.o: In function `main': > exim.c:(.text+0x1894): undefined reference to `clock_gettime' > collect2: ld

Re: [exim] Error compile exim 4.94.2

2021-05-05 Thread Jeremy Harris via Exim-users
On 05/05/2021 17:04, Sławomir Dworaczek via Exim-users wrote: when compiling exim 4.94.2 an error is shown, please help in solving the problem exim.o: In function `exim_gettime': exim.c:(.text+0xfbe): undefined reference to `clock_gettime' You don't say what platform you are compiling on, but

Re: [exim] Error compile exim 4.94.2

2021-05-05 Thread Sławomir Dworaczek via Exim-users
thanks for response, the platform is Slackware regards slawek - Original Message - From: "Jeremy Harris via Exim-users" To: Sent: Wednesday, May 5, 2021 6:43 PM Subject: Re: [exim] Error compile exim 4.94.2 On 05/05/2021 17:04, Sławomir Dworaczek via Exim-users wrote: when

Re: [exim] tainted data issues

2021-05-05 Thread Heiko Schlittermann via Exim-users
Sander Smeenk via Exim-users (Mi 05 Mai 2021 17:10:39 CEST): > Quoting Jeremy Harris via Exim-users (exim-users@exim.org): > > > It is far to easy for someone to write a matcher which just > > untaints everything, disabling the security. Three people > > would do that, and one would post it on

Re: [exim] Exim 4.94.2 - security update released

2021-05-05 Thread Heiko Schlittermann via Exim-users
Cyborg via Exim-users (Mi 05 Mai 2021 16:56:44 CEST): > Am 04.05.21 um 15:40 schrieb Heiko Schlittermann via Exim-users: > > The details about the vulnerabilities*will* be published in the near > > future (onhttp://exim.org/static/doc/security/), but not today. This > > should give you the

[exim] Error compile exim 4.94.2

2021-05-05 Thread Sławomir Dworaczek via Exim-users
Helo when compiling exim 4.94.2 an error is shown, please help in solving the problem exim.o: In function `exim_gettime': exim.c:(.text+0xfbe): undefined reference to `clock_gettime' exim.o: In function `main': exim.c:(.text+0x1894): undefined reference to `clock_gettime' collect2: ld returned

Re: [exim] prefer IPv6 over v4?

2021-05-05 Thread Olaf Hopp (SCC) via Exim-users
On 5/5/21 11:04 AM, Jeremy Harris via Exim-users wrote: On 05/05/2021 00:56, Dan Egli via Exim-users wrote: Hey everyone, quick question, more an idle thought. When exim looks up a mail to be delivered via remote_smtp, it seems to always prefer to use IPv4 even when a v6 address is available.

Re: [exim] Exim 4.94.2 - security update released

2021-05-05 Thread Cyborg via Exim-users
Am 04.05.21 um 15:40 schrieb Heiko Schlittermann via Exim-users: The details about the vulnerabilities*will* be published in the near future (onhttp://exim.org/static/doc/security/), but not today. This should give you the chance to update your systems. Time has run up:

Re: [exim] tainted data issues

2021-05-05 Thread Sander Smeenk via Exim-users
Quoting Jeremy Harris via Exim-users (exim-users@exim.org): > It is far to easy for someone to write a matcher which just > untaints everything, disabling the security. Three people > would do that, and one would post it on serverfault. Then > it would be cargo-culted forever. You mean like

Re: [exim] Sqlite Lookup absolute filename (was Exim 4.94.2 - security update released)

2021-05-05 Thread Victor Ustugov via Exim-users
Heiko Schlittermann via Exim-users wrote on 05.05.2021 16:16: > Victor Ustugov via Exim-users (Mi 05 Mai 2021 14:48:20 > CEST): >> Heiko Schlittermann via Exim-users wrote on 05.05.2021 14:57: >>> Victor Ustugov via Exim-users (Mi 05 Mai 2021 >>> 13:21:55 CEST): > I'd just refuse to create

Re: [exim] Sqlite Lookup absolute filename (was Exim 4.94.2 - security update released)

2021-05-05 Thread Heiko Schlittermann via Exim-users
Victor Ustugov via Exim-users (Mi 05 Mai 2021 14:48:20 CEST): > Heiko Schlittermann via Exim-users wrote on 05.05.2021 14:57: > > Victor Ustugov via Exim-users (Mi 05 Mai 2021 > > 13:21:55 CEST): > >>> I'd just refuse to create a bloated 4.94+fixes, instead of releasing > >>> 4.95 as soon as

Re: [exim] Sqlite Lookup absolute filename (was Exim 4.94.2 - security update released)

2021-05-05 Thread Victor Ustugov via Exim-users
Heiko Schlittermann via Exim-users wrote on 05.05.2021 14:57: > Victor Ustugov via Exim-users (Mi 05 Mai 2021 13:21:55 > CEST): >>> I'd just refuse to create a bloated 4.94+fixes, instead of releasing >>> 4.95 as soon as possible. >> >> Yesterday I built exim 4.94.2 with adapted code from

Re: [exim] Sqlite Lookup absolute filename (was Exim 4.94.2 - security update released)

2021-05-05 Thread Heiko Schlittermann via Exim-users
Heiko Schlittermann (Mi 05 Mai 2021 14:04:10 CEST): > > What did you do? I just cherry-picked the mentioned commit > > 4a7dca52352d0976f200b89a50825433b7551554 > > > > But the error didn't disappear. I'll check in more detail now. > > seems to be relevant too: >

Re: [exim] Sqlite Lookup absolute filename (was Exim 4.94.2 - security update released)

2021-05-05 Thread Heiko Schlittermann via Exim-users
Victor Ustugov via Exim-users (Mi 05 Mai 2021 13:21:55 CEST): > > I'd just refuse to create a bloated 4.94+fixes, instead of releasing > > 4.95 as soon as possible. > > Yesterday I build exim 4.94.2 with adapted code from Jeremy's commit. > It works as expected on FreeBSD (exim 4.94.2 from

Re: [exim] Sqlite Lookup absolute filename (was Exim 4.94.2 - security update released)

2021-05-05 Thread Heiko Schlittermann via Exim-users
Heiko Schlittermann (Mi 05 Mai 2021 13:57:32 CEST): > Victor Ustugov via Exim-users (Mi 05 Mai 2021 13:21:55 > CEST): > > > I'd just refuse to create a bloated 4.94+fixes, instead of releasing > > > 4.95 as soon as possible. > > > > Yesterday I build exim 4.94.2 with adapted code from Jeremy's

Re: [exim] Sqlite Lookup absolute filename (was Exim 4.94.2 - security update released)

2021-05-05 Thread Victor Ustugov via Exim-users
Heiko Schlittermann via Exim-users wrote on 05.05.2021 01:39: > Jeremy Harris via Exim-users (Mi 05 Mai 2021 00:11:59 > CEST): >> Having made me go and look... that is what I did, in b8514d1960 >> (which is since 4.94). A comma-sep option "file=/foo" after >> the word "sqlite". > > Yes, that's

Re: [exim] tainted filname issue

2021-05-05 Thread Heiko Schlittermann via Exim-users
Dan Egli via Exim-users (Mi 05 Mai 2021 02:41:38 CEST): > I just upgraded to 4.94.2, and most everything is working fine. But I'm > getting an issue on DKIM signings with tainted filename. I looked over the > list and tried to apply the same fix I've seen used before, but I guess I'm > not

Re: [exim] tainted filname issue

2021-05-05 Thread Jeremy Harris via Exim-users
On 05/05/2021 01:41, Dan Egli via Exim-users wrote:   dkim_private_key   = ${if exists{/etc/exim/DKIM/${lc:$sender_address_domain}/dkim.private.key.pem}\ {/etc/exim/DKIM/${lc:$sender_address_domain}/dkim.private.key.pem}{0}} So how do I correct this? You look up that domain in a trusted

Re: [exim] prefer IPv6 over v4?

2021-05-05 Thread Jeremy Harris via Exim-users
On 05/05/2021 00:56, Dan Egli via Exim-users wrote: Hey everyone, quick question, more an idle thought. When exim looks up a mail to be delivered via remote_smtp, it seems to always prefer to use IPv4 even when a v6 address is available. For example, in my log I see a message delivered to a

Re: [exim] tainted filname issue

2021-05-05 Thread Wolfgang Breyha via Exim-users
On 05/05/2021 02:41, Dan Egli via Exim-users wrote: >   dkim_private_key   = ${if > exists{/etc/exim/DKIM/${lc:$sender_address_domain}/dkim.private.key.pem}\ > {/etc/exim/DKIM/${lc:$sender_address_domain}/dkim.private.key.pem}{0}} That's a classic already searchable on the list... use dsearch