[ GLSA 202105-26 ] SpamAssassin

[GLSA]

Gentoo Linux Security Advisory

Title: SpamAssassin: Arbitrary command execution (GLSA 202105-26)
Severity: normal
Exploitable: local, remote
Date: 2021-05-26
Bug(s): #778002
ID: 202105-26

Synopsis

A vulnerability in SpamAssassin might allow remote attackers to
execute arbitrary commands.


Background

SpamAssassin is an extensible email filter used to identify junk email.

Affected Packages

Package: mail-filter/spamassassin
Vulnerable: < 3.4.5
Unaffected: >= 3.4.5
Architectures: All supported architectures


Description

It was discovered that SpamAssassin incorrectly handled certain CF
files.


Impact

A remote attacker could entice a user or automated system to process a
specially crafted CF file using SpamAssassin, possibly resulting in
execution of arbitrary commands with the privileges of the process or a
Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All SpamAssassin users should upgrade to the latest version: