The site makes it appear Exim never took action on their info to them more than a year ago.
other: https://security-tracker.debian.org/tracker/CVE-2023-42115
other: https://security-tracker.debian.org/tracker/CVE-2023-42115
> After our disclosure timeline was exceeded by many months, we notified the maintainer of our intent to publicly disclose these bugs, at which time we were told, "you do what you do."