chmod +x check_cve_2026_45185.sh
./check_cve_2026_45185.sh

CVE-2026-45185 (Dead.Letter) — Exim 漏洞评估
============================================================

[检查] 检查 Exim 安装...
[警告]  发现 Exim 二进制文件：/usr/sbin/exim4
[检查] 检查 Exim 版本...
        检测到版本：4.99.1
[失败]  Exim 4.99.1 在受影响范围（4.97 – 4.99.2）内。
[检查] 检查 TLS 库链接（GnuTLS vs OpenSSL）...
[失败]  Exim 链接到 GnuTLS — 此构建确实受影响。
[检查] 检查 CHUNKING (BDAT) 公告配置...
        配置文件：/etc/exim4/exim4.conf
[警告]  chunking_advertise_hosts 未禁用 — BDAT 处于活动状态（默认向所有主机公告）。
        提示：在主配置中添加 'chunking_advertise_hosts ='（空值）以禁用 BDAT 作为规避措施。
[检查] 检查系统级漏洞利用缓解措施（参考信息）...
[通过]  ASLR：完全随机化（randomize_va_space=2）
        glibc 版本：2.35（2.32+ 具有更强的堆元数据检查）
[警告]  systemd：未设置 MemoryDenyWriteExecute — 建议添加到单元
[警告]  systemd：未设置 NoNewPrivileges

------------------------------------------------------------
判定结果
------------------------------------------------------------
受影响 — CVE-2026-45185
  原因：Exim 版本 4.99.1 在受影响范围 4.97–4.99.2 内

建议操作：
  1. 将 Exim 升级到 4.99.3 或更高版本（主要修复）
  2. 作为规避措施，在 exim 配置中设置 'chunking_advertise_hosts ='（空值）
  3. 在 systemd 单元中添加 MemoryDenyWriteExecute=yes 和 NoNewPrivileges=yes
  4. 确保 ASLR 设置为 2：echo 2 > /proc/sys/kernel/randomize_va_space
------------------------------------------------------------

{
  "cve": "CVE-2026-45185",
  "alias": "Dead.Letter",
  "host": "mailserver-01",
  "timestamp": "2026-05-12T17:00:00Z",
  "verdict": "vulnerable",
  "reason": "Exim version 4.99.1 is in vulnerable range 4.97–4.99.2",
  "exit_code": 1,
  "findings": {
    "exim_binary": "/usr/sbin/exim4",
    "exim_version": "4.99.1",
    "exim_version_vulnerable": "true",
    "tls_library": "gnutls",
    "tls_library_detected": "gnutls",
    "exim_config": "/etc/exim4/exim4.conf",
    "chunking_advertised": "true",
    "aslr_level": "2",
    "glibc_version": "2.35"
  },
  "mitigations": [
    "aslr=full"
  ]
}

- name: Check for CVE-2026-45185
  run: |
    chmod +x check_cve_2026_45185.sh
    ./check_cve_2026_45185.sh --json | tee vuln-report.json
    exit $(jq '.exit_code' vuln-report.json)

- name: Upload vulnerability report
  if: always()
  uses: actions/upload-artifact@v4
  with:
    name: cve-2026-45185-report
    path: vuln-report.json

check-exim-vuln:
  stage: security
  script:
    - chmod +x check_cve_2026_45185.sh
    - ./check_cve_2026_45185.sh --json > vuln-report.json
  artifacts:
    when: always
    paths:
      - vuln-report.json
  allow_failure: false

- name: Run CVE-2026-45185 check
  script: check_cve_2026_45185.sh --json
  register: vuln_check
  failed_when: vuln_check.rc == 1
  changed_when: false

- name: Show vulnerability report
  debug:
    msg: "{{ vuln_check.stdout | from_json }}"

# 仅获取判定结果
./check_cve_2026_45185.sh --json | jq -r '.verdict'

# 检查是否发现了特定缓解措施
./check_cve_2026_45185.sh --json | jq '.mitigations | contains(["aslr=full"])'

# 跨多台主机运行并收集结果
for host in mail1 mail2 mail3; do
  ssh "$host" 'bash -s' < check_cve_2026_45185.sh --json
done | jq -s '.'

# Debian / Ubuntu
apt-get update && apt-get install --only-upgrade exim4

# RHEL / CentOS / Fedora
dnf upgrade exim

# 从源码
# 从 https://ftp.exim.org/pub/exim/exim4/ 下载 4.99.3
# 并使用现有的 Local/Makefile 设置重新构建

exim -bV | head -1
# 预期输出：Exim version 4.99.3 ...

chunking_advertise_hosts =

# Debian / Ubuntu
systemctl restart exim4

# 其他 systemd 系统
systemctl restart exim

# 连接并检查 EHLO 响应——应不出现 CHUNKING
echo QUIT | openssl s_client -connect localhost:25 -starttls smtp 2>/dev/null \
  | grep -i chunking
# 无输出 = CHUNKING 已禁用

# /etc/systemd/system/exim4.service.d/hardening.conf
[Service]
NoNewPrivileges=yes
MemoryDenyWriteExecute=yes
ProtectSystem=strict
PrivateTmp=yes
RestrictAddressFamilies=AF_INET AF_INET6
SystemCallFilter=@system-service

systemctl daemon-reload && systemctl restart exim4