Alpine: perl-mail-spamassassin, multiple spamassassin packages: security update to 3.4.1-r8 (deprecated)

critical Tenable Self-Hosted Container Security Plugin ID 400650

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4)
cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7)
cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10)
cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails,
(13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-
ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18)
utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL,
(23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and
5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory
array, which might allow local users to gain privileges via a Trojan horse module under the current
working directory. (CVE-2016-1238)

- A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The
vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly
leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the
begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close"
event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the
"text" event to deal with the object normally. This can cause carefully crafted emails that might take
more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design
decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly
formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a
Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the
future. (CVE-2017-15705)

- A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.
(CVE-2018-11780)

- Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax. (CVE-2018-11781)

Plugin Details

Severity: Critical

ID: 400650

Version: Revision 1.25

Type: Local

Family: Alpine Linux Local Security Checks

Published: 8/16/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 97.35

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2018-11780

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/26/2018

Vulnerability Publication Date: 7/26/2016

Reference Information

CVE: CVE-2016-1238, CVE-2017-15705, CVE-2018-11780, CVE-2018-11781

BID: 105347, 105373, 92136

IAVA: 2018-A-0332-S

Detections

Analytics