The Patching Friars' AlmanacA calendar of CVE saints

May 4

21NailsHoly card for 21nails, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 XXI 21Nails XXI CLAVI IN EPISTULA
🤖 Image and text generated with AI

⬇ Download holy card: ·

⚔ Commemorated today: The Poisoned Love Letter (2000)

Embed on your site

Saint 21Nails, of the Twenty-One Nails

Patron of mail servers, code that ages without anyone rereading it, and people who count nails one by one.

Life

On 4 May 2021 the Qualys research team revealed 21Nails: twenty-one vulnerabilities in the Exim mail server, eleven local and ten remote. Chained together, some let an unauthenticated attacker run code as root, and many dated back to 2004, the start of the project's Git history. Exim was then among the most widespread mail servers on the internet, with millions of exposed instances.

Prayer

O Saint 21Nails, who drove twenty-one nails into the world's mail, let our SMTP daemons be updated before anyone counts their flaws. Amen.

How to celebrate

Celebrated by updating Exim to at least version 4.94.2 and, now and then, rereading code written seventeen years earlier.

One nail drives out another, but twenty-one drive out the postman.

Technical record

Disclosed on
May 4 2021
CVE
CVE-2020-28017

Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption.

Sources: blog.qualys.com

Commemorated today

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.