I've vouched no less than four reasonable comments under this post. Was there a mass flagging campaign?
Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim
41–48 of 48 posts
Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim
#42It says coordinated distro release today, and I've received a notice earlier today but that does not include the CVE number. That's confusing / does not seem very coordinated to release 2 separate security update notices in a day. https://lists.debian.org/debian-security-announce/2026/msg00...
Yes, this was weird.
I saw that announcement yesterday, went through the list of fixed issues and decided to wait with the upgrade since none of them were relevant for me.
If I haven't just seen this on the second page of HN I would have probably deferred this upgrade for a few more days.
Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim
#43Earlier quoted context omitted.
There's a weird folk belief that Exim is a secure 2nd-generation MTA, but it's not; it's a 1st generation MTA, like Sendmail and Smail. The two "secure" 2nd generation MTAs are Postfix and qmail. You shouldn't use those either, really; there is no reason to run a memory-unsafe MTA, or, for that matter, an MTA that isn't backed by a real database.
Which one would you suggest using? I’ve been looking at Stalwart to replace my old exim setup, wondering if it’s a reasonable choice.
Another memory-safe option is Haraka, which I’ve been using for several years now. I recommend it but only for people who need extreme customizability. For everyone else, the customizability is a bit of a footgun, since you can easily end up with accidental open relays and other misconfigurations (as I learned the hard way).
Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim
#44Earlier quoted context omitted.
And? then keep it for yourself. Why do i have to read your ignorant comment? You complain about their writing style, no one forced you to read, which you could summarize with an AI if you even cared for the conent but no. And i read A LOT and i do not come across this writing style at all.
>And? then keep it for yourself. Why do i have to read your ignorant comment? On a site dedicated to commenting on articles? I think you have a misunderstanding of how HN works. People (hopefully) read the article and share uninformed^H informed opinions on the article. That has always included critique of the way that the content is written. In this case, very valid critique. I'm astounded you're somehow managing to…
Its not valid critique at all.
And its disrespectful to people who create proper content and do the work.
Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim
#45Never heard of Exim, I'm just realizing what it is: > Exim is an open-source Mail Transfer Agent (MTA) designed for Unix-like systems to receive, route, and deliver email. what's the significance of this? do people use this in production systems?
I had the exact same reaction - never heard of this.
Then perhaps you haven't been around for very long. Have a look here before you put your feet in your mouth any further:
Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim
#46Earlier quoted context omitted.
Many years ago I used Exim because it was default for my distro of choice back then. But after a few emergency patchings caused by yet another RCE in Exim I learned that switching to Postfix massively improved my sleep quality.
There's a weird folk belief that Exim is a secure 2nd-generation MTA, but it's not; it's a 1st generation MTA, like Sendmail and Smail. The two "secure" 2nd generation MTAs are Postfix and qmail. You shouldn't use those either, really; there is no reason to run a memory-unsafe MTA, or, for that matter, an MTA that isn't backed by a real database.
> for that matter, an MTA that isn't backed by a real database.
I use Postfix with MySQL, what is the issue with that?
Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim
#47>The bug is a use-after-free triggered when a TLS connection is handled by GnuTLS Color me surprised. The GNU ecosystem has had more than its fair share of CVEs over the years to the point that it's now a common trope: https://soatok.blog/2020/07/08/gnu-a-heuristic-for-bad-crypt...
Debian builds Exim against GnuTLS because OpenSSL used to use a license with an advertising clause, making it incompatible with the GPLd Exim.
Since OpenSSL 3 is now available under a GPL-compatible license, I think it's long past time to switch. But judging by the sorry state of https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446036 I don't think it's going to happen any time soon.
Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim
#48Never heard of Exim, I'm just realizing what it is: > Exim is an open-source Mail Transfer Agent (MTA) designed for Unix-like systems to receive, route, and deliver email. what's the significance of this? do people use this in production systems?
Exim is apparently the largest email server these days... it used to be postfix, but with most people using Gmail or 365, running your own email seems to be an afterthought. /shrug
Postfix has a far better security track record. Exim has a steady stream of CVEs.