On Thu, Jan 30, 2020 at 01:49:55PM -0500, Stephen John Smoogen wrote:
Currently opensmtpd has a high level remote CVE and several others
release listed. I have tried to compile the updated version but […]
According to the oss-security list, this vulnerability has been made
exploitable in May 2018 - the version in EPEL (and Fedora) is 6.0.3,
which was released on Jan 4, 2018.
I would like to remove opensmtpd from EPEL. If someone wants to
it that would be great also but it might become a long war of attrition.
I'd prefer just retiring the epel branch. I'm not using it myself, but
as it seems the CVEs I could find for OpenSMTPd do not affect the EPEL
version I wouldn't remove/obsolete already installed packages.
In Fedora there seems to be activity in OpenSMTPd (only checked
bugzilla), so maybe the Fedora Maintainer is interested in also taking
the EPEL branch? (I've cc'ed the Fedora Maintainer, hope that's okay.)
All the best,