All of lore.kernel.org
 help / color / mirror / Atom feed
From: Thomas Petazzoni via buildroot <buildroot@buildroot.org>
To: nvd <nvd@nist.gov>
Cc: "buildroot@buildroot.org" <buildroot@buildroot.org>
Subject: [Buildroot] CVE-2022-3620 version range fix
Date: Sat, 17 May 2025 18:30:00 +0200	[thread overview]
Message-ID: <20250517183000.40b28b4d@windsurf> (raw)

Hello,

CVE-2022-3620 is documented in your database as affecting version
2022-10-18 of exim, which doesn't make much sense as there is no such
version released by the exim project. See their version naming scheme
by looking at their Git tags:

  https://code.exim.org/exim/exim/tags

The Debian Security Tracker at
https://security-tracker.debian.org/tracker/CVE-2022-3620 documents
that this CVE was introduced in commit
92583637b25b6bde926f9ca6be7b085e5ac8b1e6, which first appeared in the
release 4.95 of exim:

$ git tag --contains 92583637b25b6bde926f9ca6be7b085e5ac8b1e6 | sort | head -1
exim-4.95

And was subsequently fixed by 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445
which first appeared in the release 4.97 of exim:

$ git tag --contains 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445 | sort | head -1
exim-4.97

Therefore, your entry CVE-2022-3620 should be updated to reflect that
version 4.95 to 4.97 are affected.

Do you think you could adjust this in your database?

Thanks a lot!

Thomas Petazzoni
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

                 reply	other threads:[~2025-05-17 16:30 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250517183000.40b28b4d@windsurf \
    --to=buildroot@buildroot.org \
    --cc=nvd@nist.gov \
    --cc=thomas.petazzoni@bootlin.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.